CVE-2026-6494

{
  "id": "CVE-2026-6494",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-17T09:16:05.600",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in the AAP MCP server. An unauthenticated remote attacker can exploit a log injection vulnerability by sending specially crafted input to the `toolsetroute` parameter. This parameter is not properly sanitized before being written to logs, allowing the attacker to inject control characters such as newlines and ANSI escape sequences. This enables the attacker to obscure legitimate log entries and insert forged ones, which could facilitate social engineering attacks, potentially leading to an operator executing dangerous commands or visiting malicious URLs."
    },
    {
      "lang": "es",
      "value": "Se encontró una falla en el servidor AAP MCP. Un atacante remoto no autenticado puede explotar una vulnerabilidad de inyección de registros enviando una entrada especialmente diseñada al parámetro ’toolsetroute’. Este parámetro no se sanea correctamente antes de ser escrito en los registros, permitiendo al atacante inyectar caracteres de control como saltos de línea y secuencias de escape ANSI. Esto permite al atacante oscurecer entradas de registro legítimas e insertar entradas falsificadas, lo que podría facilitar ataques de ingeniería social, potencialmente llevando a un operador a ejecutar comandos peligrosos o a visitar URLs maliciosas."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat Ansible Automation Platform 2",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "ansible-automation-platform-tech-preview/mcp-server-rhel9",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-18T02:51:47.479832Z",
          "id": "CVE-2026-6494",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-117"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-6494",
      "source": "[email protected]"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459131",
      "source": "[email protected]"
    }
  ]
}