CVE-2026-84717

Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated Webhook HMAC Bypass in Ansible Automation Platform

Publication date: 2026-09-23

Last updated on: 2026-09-26

Assigner: redhat-SADP

Description

A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target template, causing the endpoint to return HTTP 200 for a template that has a Bitbucket DC webhook configured and HTTP 403 otherwise. An unauthenticated remote attacker can use this response discrepancy as an oracle to enumerate which Job Template and Workflow Job Template IDs have Bitbucket DC webhooks configured, without knowing the secret webhook_key.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-26

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-12

NVD

CVE-2026-84717

EUVD

EUVD-2026-85612

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	ansible_automation_platform	*
red_hat	ansible_automation_platform	2.5
red_hat	ansible_automation_platform	2.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-204	The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

CVE-2026-84717 is a flaw in the Ansible Automation Platform's automation-controller. The Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after checking a target template. This causes the endpoint to return HTTP 200 if a Bitbucket DC webhook is configured for a template and HTTP 403 otherwise. An attacker can exploit this response difference to enumerate which Job Template and Workflow Job Template IDs have Bitbucket DC webhooks configured without knowing the secret webhook_key.

Detection Guidance

To detect this vulnerability, monitor HTTP responses from the Bitbucket Data Center webhook receiver endpoint. Send requests with the header 'X-Event-Key: diagnostics:ping' to the webhook URL and observe if responses return HTTP 200 for valid templates or HTTP 403 for invalid ones. Automate this by scripting requests to enumerate template IDs and check for inconsistent responses.

Impact Analysis

This vulnerability allows unauthenticated attackers to identify which job templates have Bitbucket DC webhooks configured. This information could be used to focus further attacks, such as brute-force or spoofing attempts, on valid templates. While it does not directly expose secrets or disrupt services, it aids in reconnaissance for potential follow-up exploits.

Compliance Impact

This vulnerability primarily enables unauthenticated enumeration of job templates with Bitbucket DC webhooks configured. While it does not directly expose sensitive data, it could facilitate targeted attacks on specific templates, potentially leading to unauthorized access or data exfiltration if combined with other exploits. This may impact compliance with GDPR by increasing risk of unauthorized data processing and HIPAA by potentially exposing healthcare-related automation workflows.

Mitigation Strategies

Apply the latest security patches from Red Hat for Ansible Automation Platform versions 2.5 and 2.6 via RHSA-2026:71113 and RHSA-2026:71114. Alternatively, disable the diagnostics:ping endpoint or enforce HMAC signature verification for all ping events to prevent response discrepancy exploitation.

Hi! I’m here to help you understand CVE-2026-84717. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70