CVE-2026-84470

Received Received - Intake

Bulk Job Launch Permission Bypass in Ansible Automation Platform

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: redhat-SADP

Description

A flaw was found in Ansible Automation Platform's automation-controller (AWX). The Bulk Job Launch API (POST /api/v2/bulk/job_launch/) authorizes the requested instance_groups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same field. A principal that holds read (but not use) permission on an instance group -- for example the built-in read-only System Auditor role -- together with execute permission on a job template can launch bulk jobs onto instance groups they are not authorized to use, bypassing execution-placement isolation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-84470

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	ansible_automation_platform	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is in Ansible Automation Platform's automation-controller (AWX). It allows users with read-only permissions on instance groups to launch bulk jobs onto those groups, bypassing execution-placement restrictions. Normally, single-job launches require use-level permissions, but bulk launches only check read permissions.

Impact Analysis

An attacker with read-only access could execute unauthorized bulk jobs on restricted instance groups. This could lead to resource misuse, unintended job execution, or potential disruption of operations if combined with other vulnerabilities.

Compliance Impact

This vulnerability allows unauthorized bulk job launches on instance groups, potentially enabling data access or processing outside permitted scopes. This could violate data protection principles in GDPR and HIPAA by enabling unauthorized execution environments for sensitive workloads.

Mitigation Strategies

Update Ansible Automation Platform to the latest version where this flaw is patched. Review and restrict permissions for instance groups, ensuring only authorized users have execute permissions on job templates and use-level access to instance groups.

Hi! I’m here to help you understand CVE-2026-84470. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70