An argument‑injection flaw exists in the system‑job subsystem of the Ansible Automation Platform automation‑controller. The launch endpoint stores a user‑supplied "days" variable without enforcing the integer validation that normally protects the field, and the dispatcher later flattens the management‑command argument list into a single string. Spaces in the supplied value become additional command‑line arguments. Because system jobs run directly on the control node, an authenticated superuser can inject arbitrary arguments—including Python’s "-m" path option—into the control‑plane awx‑manage process, altering its argument vector and the first entry of its module search path. Full remote code execution would require an import gadget that is not present in the current management commands, so the confirmed impact is argument injection with control of the process search path rather than direct code execution.

This vulnerability affects Red Hat Ansible Automation Platform 2. All versions of this product that include the automation‑controller system‑job subsystem are impacted. The specific version range is not listed in the advisory, so any deployed instance of the platform is potentially susceptible.

The CVSS score of 6.6 indicates moderate severity, while the EPSS score is not available. It is not listed in CISA’s KEV catalog. Exploitation requires authenticated access and superuser privileges, limiting the attack surface to privileged accounts. The flaw allows manipulation of the module search path, which could enable an attacker to influence module loading and potentially pave the way for further compromise. However, the flaw does not provide immediate remote code execution without additional gadgets.