CVE-2026-84716

Awaiting Analysis Awaiting Analysis - Queue

Certificate Authority Spoofing in Ansible Automation Controller

Publication date: 2026-09-23

Last updated on: 2026-09-24

Assigner: redhat-SADP

Description

A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the Common Name, DNS subject-alternative-name, and receptor node-id are taken verbatim from the caller-chosen instance hostname, with a hard-coded ten-year validity, a random serial, and no issuance log or revocation list. Because the hostname charset validator is case-insensitive while the uniqueness validator is case-sensitive, an administrator can register a case variant of an existing control node's hostname and obtain a mesh-CA-signed certificate that TLS peers, which match hostnames case-insensitively, accept as that control node. In managed/hosted deployments — where the customer holds controller superuser but the platform operator runs the mesh — this yields a long-lived, non-revocable mesh peer credential and, with an on-path position, TLS impersonation or interception of control/hybrid mesh nodes. It does not grant direct remote code execution, because receptor work submission is gated by a separate signing key not included in the bundle.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-24

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-12

NVD

CVE-2026-84716

EUVD

EUVD-2026-85611

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	automation_controller	*
red_hat	ansible_automation_platform	From 2.6 (inc)
red_hat	ansible_automation_platform	From 2.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability is a privilege and trust-boundary flaw in Red Hat Ansible Automation Platform's automation-controller. It occurs in the install-bundle endpoint where a system administrator can download a node's install bundle containing a private key and X.509 certificate signed by the receptor mesh CA. The certificate's details are derived from the instance hostname, which the administrator can manipulate due to a case-sensitivity mismatch in hostname validation. This allows registering a case variant of an existing hostname to obtain a mesh-CA-signed certificate that TLS peers accept as legitimate, enabling impersonation or traffic interception in managed or hosted deployments.

Detection Guidance

To detect this vulnerability, inspect the receptor mesh CA for duplicate hostnames with case variations in issued certificates. Check the install-bundle endpoint logs for unauthorized certificate issuance. Use commands like 'openssl x509 -in cert.pem -noout -subject' to examine certificate subjects and 'grep -i hostname /var/lib/receptor/mesh/ca/*' to find case variants.

Impact Analysis

In managed or hosted deployments, a customer-tier administrator could exploit this to obtain a long-lived, non-revocable mesh peer credential. With network access, this enables TLS impersonation or interception of control/hybrid mesh nodes, compromising confidentiality. The certificate does not grant direct code execution but allows traffic interception if positioned on the network path. Self-managed installations face minimal risk as the administrator already controls the mesh CA.

Compliance Impact

This vulnerability could lead to unauthorized access or interception of sensitive data transmitted between mesh nodes, potentially violating confidentiality requirements in GDPR and HIPAA. The lack of revocation capability and long validity period exacerbates compliance risks by allowing persistent unauthorized access. Organizations must address this flaw to maintain data protection standards.

Mitigation Strategies

Upgrade to Red Hat Ansible Automation Platform 2.6 for RHEL 10 and 9 via RHSA-2026:71113 or Red Hat Ansible Automation Platform 2.5 for RHEL 9 and 8 via RHSA-2026:71114.
In managed or hosted environments, rotate the mesh CA key to invalidate all existing certificates if upgrading is not immediately possible.
Monitor for unauthorized certificate issuance or hostname registration attempts in the automation-controller logs.

Hi! I’m here to help you understand CVE-2026-84716. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70