CVE-2026-84474
Awaiting Analysis Awaiting Analysis - Queue

Information Disclosure in Red Hat Ansible Automation Platform

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: redhat-SADP

Description
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret (host_config_key) is exposed to users holding only the read-level view_jobtemplate permission -- both in the job template API representation and in the activity stream -- and the provisioning callback endpoint trusts a client-supplied X-Forwarded-For header to determine the calling host when the controller is deployed behind the AAP gateway with an empty proxy allow-list. By reading the secret and spoofing X-Forwarded-For to match any host in the job template's inventory, a minimally privileged or unauthenticated remote attacker can launch the job template against arbitrary managed hosts using the job template's credentials, resulting in privilege escalation and remote code execution on managed hosts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-84474
EUVD
EUVD-2026-85555

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
red_hat ansible_automation_platform *
red_hat ansible_automation_platform 2.5
red_hat ansible_automation_platform 2.6
red_hat ansible_automation_platform 2.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-807 The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Red Hat Ansible Automation Platform's automation-controller exposes the provisioning-callback secret (host_config_key) to users with read-level view_jobtemplate permission. When deployed behind an AAP gateway with an empty proxy allow-list, the controller trusts a client-supplied X-Forwarded-For header to determine the calling host. An attacker can read the secret, spoof the header to match any host in the job template's inventory, and launch the job template against arbitrary managed hosts using its credentials, leading to privilege escalation and remote code execution.

Detection Guidance

Check for unauthorized access to job template API representations or activity streams for exposed host_config_key secrets. Review X-Forwarded-For headers in provisioning callback logs for spoofing attempts. Monitor for suspicious job launches against arbitrary hosts using job template credentials.

Impact Analysis

An attacker could gain unauthorized access to managed hosts, execute arbitrary code with elevated privileges, and potentially take control of systems managed by Ansible Automation Platform. This could lead to data breaches, system compromise, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies
  • Restrict view_jobtemplate permissions to only necessary users.
  • Disable provisioning callback on unnecessary job templates.
  • Set PROXY_IP_ALLOWED_LIST to gateway addresses to validate X-Forwarded-For headers.
  • Rotate exposed host_config_key values immediately.
  • Review activity_stream access logs for unauthorized access.
  • Monitor job launches for suspicious activity targeting arbitrary hosts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84474. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart