A flaw in Red Hat Ansible Automation Platform’s automation‑controller allows a privileged user to write a malicious script into the credential injector’s execution environment and then redirect a process‑hijacking variable such as BASH_ENV to that script. The custom environment‑variable injector performs name validation against a deny‑list that unintentionally omits critical loader variables like BASH_ENV, LD_PRELOAD, and PYTHONSTARTUP. When such an environment variable points to an attacker‑controlled script, it is executed within the container that runs any job using the affected credential type, giving the attacker arbitrary code execution inside that job’s isolated environment.

Red Hat Ansible Automation Platform 2, as identified by the CVE sources. No finer version granularity is listed, but the vulnerability applies to all instances of the platform that use the default env‑injector credential type within version 2. Any deployment of this product that relies on that credential type is potentially vulnerable.

The CVSS score of 7.6 indicates a high severity, and although an EPSS score is not available, the vulnerability is not currently listed in the CISA KEV catalog. The attack requires a privileged user with access to the automation‑controller to create or modify credentials. Once such a credential is attached to a job, the attacker can coerce the container runtime into executing arbitrary code. This combination of high impact and the necessity of privileged access results in a significant risk for organizations that allow broad administrator rights and deploy the vulnerable platform. Immediate patching is recommended to eliminate the attack vector.