CVE-2026-84712
Received
Received - Intake
Unauthenticated RBAC Data Exposure in Ansible Automation Controller
Vulnerability report for CVE-2026-84712, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-09-23
Last updated on: 2026-09-23
Assigner: redhat-SADP
Description
Description
A flaw was found in the automation-controller API. The
unauthenticated health-check endpoint /api/v2/ping/
(ApiV2PingView, AllowAny) over-serializes RBAC-gated
automation-mesh data into its anonymous response, exposing the
full instance inventory (node hostnames, node types, UUIDs,
heartbeats, capacities, and exact versions), all instance-group
names and membership, the deployment install UUID, and the
active control node. A remote, unauthenticated attacker can use
this to map the control plane and fingerprint software versions
for targeted attacks. This flaw affects confidentiality only;
it does not expose secrets, credentials, or tenant data.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| redhat | automation-controller | * |
| red_hat | ansible_automation_platform | 2.5 |
| red_hat | ansible_automation_platform | 2.6 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-497 | The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does. |
