A critical command injection vulnerability in the Red Hat Ansible Automation Platform allows authenticated attackers to execute arbitrary code on the control-plane task pod, risking full cross-tenant compromise.

The vulnerability is an argument injection flaw (CWE-88) where the Project scm_url field is not properly validated before being passed to the git SCM module. An authenticated user with permissions to create or modify projects can inject malicious git options, resulting in shell execution on the underlying infrastructure.

The ability to execute arbitrary commands on the control-plane task pod poses an extreme risk to the integrity and confidentiality of the entire automation environment. With a CVSS score of 9.9, this vulnerability enables cross-tenant compromise, potentially allowing an attacker to move laterally across the cluster and access sensitive secrets or credentials stored within the Ansible Automation Platform.

Immediate Action: Update your Red Hat Ansible Automation Platform installation to the versions specified in the Red Hat security advisories: 2.4 (4.5.36-1.el8ap/el9ap), 2.5 (4.6.33-1.el8ap/el9ap), or 2.6 (4.7.17-1.el9ap or 1789673739).

Proactive Monitoring: Audit project configurations for suspicious URLs starting with hyphens or unusual git parameters and monitor project update logs for unexpected command outputs.

Compensating Controls: Implement strict role-based access control to restrict project creation and modification rights to trusted personnel only until patches are applied.

Public Exploit Available: Unknown

Given the critical CVSS severity and the potential for total control-plane compromise, organizations must prioritize patching these affected versions immediately. Review the linked Red Hat errata to ensure the correct version path is applied for your specific deployment environment.