CVE-2026-84718

Awaiting Analysis Awaiting Analysis - Queue

IP Spoofing in Ansible Automation Platform Controller

Publication date: 2026-09-23

Last updated on: 2026-09-24

Assigner: redhat-SADP

Description

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost (attacker-controlled) header value. As a result, an attacker can forge the source IP address recorded for their requests in the Controller's audit and access logs, degrading the integrity of forensic and SIEM attribution. The flaw does not grant additional access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-24

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-84718

EUVD

EUVD-2026-85613

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	ansible_automation_platform	-
red_hat	ansible_automation_platform	2.5
red_hat	ansible_automation_platform	2.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-348	The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Ansible Automation Platform's automation-controller. It allows an attacker to forge the source IP address recorded in audit and access logs by exploiting the X-Forwarded-For header. The system trusts this header without verifying it comes from a trusted proxy, and selects the leftmost (attacker-controlled) value. This compromises the integrity of forensic and SIEM attribution but does not grant additional access.

Detection Guidance

Check the automation-controller logs for inconsistencies in the X-Forwarded-For header values. Look for requests where the leftmost IP in the header does not match the expected proxy chain. Use commands like grep to search for 'X-Forwarded-For' in logs and compare with trusted proxy IPs.

Impact Analysis

The impact is limited to log integrity. Attackers can manipulate recorded IP addresses in audit and access logs, potentially misleading forensic investigations or SIEM systems. This does not allow unauthorized access or data disclosure but may hinder accurate attribution of malicious activities.

Compliance Impact

This vulnerability may affect compliance by compromising the integrity of audit logs required by standards like GDPR and HIPAA. Forensic accuracy is critical for compliance, and forged IP addresses in logs could lead to incorrect conclusions during audits or investigations, potentially violating record-keeping requirements.

Mitigation Strategies

Update the automation-controller to versions 2.5 or 2.6 via RHSA-2026:71113 or RHSA-2026:71114. Configure a non-empty PROXY_IP_ALLOWED_LIST to validate trusted proxies. Alternatively, modify the application to select the rightmost IP in the X-Forwarded-For header instead of the leftmost.

Hi! I’m here to help you understand CVE-2026-84718. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70