CVE-2026-84724

*** Pendiente de traducción *** An argument-injection flaw was found in the Ansible Automation Platform automation-controller<br /> system-job subsystem. The system-job template launch endpoint stores a user-supplied "days"<br /> variable without running the integer validation defined elsewhere for that field, and the<br /> dispatcher flattens the management-command argument list into a single string with spaces before<br /> the job runner re-splits it, so spaces in the value become additional command-line arguments.<br /> Because system jobs are executed in-process on the control node without the container isolation<br /> applied to all other job types, an authenticated user with superuser privileges can inject<br /> arbitrary arguments — including Python&amp;#39;s path option — into the control-plane awx-manage process,<br /> controlling its argument vector and the first entry of its module search path. Full remote code<br /> execution requires an additional import gadget that is not present in the current management<br /> commands, so the demonstrated impact is argument injection with control of the process search<br /> path rather than confirmed code execution.