CVE-2026-84502

CVE-2026-84502 is a vulnerability identified in the automation-controller component of Red Hat Ansible Automation Platform. The flaw stems from insufficient validation of the `Project scm_url` field. This field, when not properly sanitized, is passed directly to the `git SCM` module. Specifically, the `git ls-remote` command, which is executed by the module, does not use a "--" separator. This oversight allows a malicious Git project URL, crafted to begin with a dash (e.g., "--upload-pack=<command>:x"), to be interpreted as a `git` option. Consequently, an authenticated user with permissions to create or modify a project within a single organization can execute arbitrary commands on the control-plane task pod, with the output visible through the project update stdout endpoint. This can lead to cross-tenant compromise and lateral movement within the cluster.