CVE-2026-84486
Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated Scheduler Lock Acquisition in Ansible Automation Platform

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: redhat-SADP

Description
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views that trigger the internal task, dependency, and workflow schedulers are configured to allow any user (including unauthenticated clients) and are routed in production builds because their URL include is not gated on the debug setting. An unauthenticated remote attacker can repeatedly invoke these endpoints to acquire the cluster-wide scheduler advisory lock; because the legitimate scheduler acquires the same lock without waiting, the attacker causes real scheduler runs to be skipped, stalling job dispatch for all tenants, while also consuming controller web workers. The debug root view additionally discloses the list of debug endpoints to unauthenticated callers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-84486
EUVD
EUVD-2026-85548

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
red_hat ansible_automation_platform *
red_hat automation_controller *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-489 The product is released with debugging code still enabled or active.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Red Hat Ansible Automation Platform's automation-controller involves four debug views that trigger internal schedulers (task, dependency, and workflow). These views are accessible to any user, including unauthenticated clients, due to improper URL routing in production builds. Attackers can repeatedly invoke these endpoints to acquire the cluster-wide scheduler advisory lock, causing legitimate scheduler runs to be skipped and stalling job dispatch for all tenants while consuming web workers.

Detection Guidance

Check for unauthorized access to debug endpoints by monitoring web server logs for repeated requests to scheduler-trigger URLs. Look for unusual patterns in job dispatch logs indicating skipped scheduler runs. Verify if unauthenticated users can access the debug root view listing endpoints.

Impact Analysis

An unauthenticated attacker could exploit this flaw to disrupt job scheduling in your Ansible Automation Platform, leading to a denial-of-service condition where jobs are not dispatched. This could halt automation tasks across all tenants, consume system resources, and potentially cause operational delays or failures in automated workflows.

Compliance Impact

This vulnerability could impact compliance by disrupting automated processes that handle sensitive data, potentially leading to unauthorized access or data processing delays. While not directly violating GDPR or HIPAA, the resulting downtime or unauthorized access risks may create compliance gaps if automation tasks are interrupted or if debug endpoints expose sensitive information.

Mitigation Strategies

Apply the official patch from Red Hat to restrict debug endpoints to administrators and disable them by default. Temporarily block external access to the automation-controller web interface until patched. Monitor scheduler logs for skipped job dispatches as an indicator of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84486. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart