CVE-2026-84712

Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated RBAC Data Exposure in Ansible Automation Controller

Publication date: 2026-09-23

Last updated on: 2026-09-24

Assigner: redhat-SADP

Description

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory (node hostnames, node types, UUIDs, heartbeats, capacities, and exact versions), all instance-group names and membership, the deployment install UUID, and the active control node. A remote, unauthenticated attacker can use this to map the control plane and fingerprint software versions for targeted attacks. This flaw affects confidentiality only; it does not expose secrets, credentials, or tenant data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-24

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-12

NVD

CVE-2026-84712

EUVD

EUVD-2026-85609

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	automation-controller	*
red_hat	ansible_automation_platform	2.5
red_hat	ansible_automation_platform	2.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-497	The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Attack-Flow Graph

Executive Summary

CVE-2026-84712 is an information-disclosure flaw in Red Hat Ansible Automation Platform's automation-controller API. The unauthenticated /api/v2/ping/ endpoint, meant for health checks, exposes sensitive automation-mesh data. It reveals instance inventory details like hostnames, node types, UUIDs, versions, and capacities, along with instance-group names, membership, deployment UUIDs, and active control nodes. This allows attackers to map the control plane and identify targets for further exploits.

Detection Guidance

Check if the /api/v2/ping/ endpoint is accessible from untrusted networks by using curl commands like 'curl -k https://<controller-ip>/api/v2/ping/' to inspect the response for exposed inventory data. Monitor network traffic for unauthorized access attempts to this endpoint.

Impact Analysis

This vulnerability enables remote attackers to gather detailed system information without authentication. They can map your automation infrastructure, identify high-value nodes, and fingerprint software versions to plan targeted attacks. While it doesn't expose credentials or tenant data, the exposed topology could help attackers exploit other vulnerabilities or bypass security controls.

Compliance Impact

This vulnerability may impact compliance by exposing system topology and software versions, which could be considered sensitive information under GDPR or HIPAA. While it doesn't directly leak personal or health data, the unauthorized disclosure of infrastructure details may violate data protection principles requiring security of processing environments. Organizations should assess exposure and apply mitigations to maintain compliance.

Mitigation Strategies

Restrict access to the Controller API by ensuring it is not exposed to untrusted networks. Use network-level controls like firewalls to block external access to the /api/v2/ping/ endpoint. Apply patches from Red Hat Product Errata RHSA-2026:71113 or RHSA-2026:71114 depending on your Ansible Automation Platform version.

Hi! I’m here to help you understand CVE-2026-84712. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70