CVE-2026-85475: Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslog component
A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-controlled settings — LOGAGGREGATORHOST, LOGAGGREGATORMAXDISKUSAGEPATH and LOGAGGREGATORRSYSLOGDERRORLOGFILE — into an rsyslog RainerScript config file without neutralizing RainerScript syntax. A privileged (superuser) user can inject rsyslog directives, including an omprog action, causing arbitrary command execution inside the control-plane rsyslog component. This allows disclosure of the controller SECRETKEY and database credentials, decryption of all stored credentials, and full compromise of the control plane.
Other sources
Controller registers LOGAGGREGATORHOST as a bare CharField with no character validation, and the logging settings validator only verifies that host/type are present. When any LOGAGGREGATOR setting is changed via PATCH /api/controller/v2/settings/logging/ (superuser-only), Controller regenerates /var/lib/awx/rsyslog/rsyslog.conf and restarts awx-rsyslogd. In the tcp/udp (omfwd) code path the host value is written raw as target="{host}", allowing an attacker to close the action() statement and append module(load="omprog") plus an omprog action() whose binary= runs an arbitrary shell command in the rsyslog control-plane component (uid=awx). That process can read SECRETKEY and the Postgres credentials, decrypt every stored Credential, and forge inter-service JWTs. Upstream: https://github.com/ansible/awx (devel) — UNFIXED (no PR) Affected file: awx/main/utils/externallogging.py (constructrsyslogconftemplate: :26 spoolDirectory, :100 errorfile, :128 target); awx/main/conf.py (:565-574, :958-979); awx/conf/views.py (:131-133)
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires a privileged superuser account. The relevant logging settings endpoint, PATCH /api/controller/v2/settings/logging/, is superuser-only; ordinary users are not described as having access to the vulnerable update path.
Which configuration changes are relevant to exploitation?
The affected user-controlled settings are LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH, and LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE. The documented injection path is through LOG_AGGREGATOR_HOST in the TCP/UDP forwarding configuration, where the host is written directly into an rsyslog action target.
What evidence can indicate an attempted or successful exploitation?
Review superuser changes made through the logging settings API, especially changes to LOG_AGGREGATOR* values. Each such change regenerates /var/lib/awx/rsyslog/rsyslog.conf and restarts awx-rsyslogd, so unexpected directives or command-executing omprog actions in that generated file are significant indicators.