CVE-2026-94416
Received Received - Intake

Authorization Bypass in Ansible Automation Platform Gateway

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: redhat-SADP

Description
An authorization bypass was found in the Ansible Automation Platform (AAP) gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. Because service-key creation is not restricted to the installer-provisioned provisioning path, an administrator-issued key is cryptographically indistinguishable from a legitimate one and can be used to forge a service-authentication token that impersonates the Controller service. Combined with the gateway OIDC workload-identity endpoint (enabled via FEATURE_OIDC_WORKLOAD_IDENTITY_ENABLED), the attacker can drive the gateway to sign Workload Identity Tokens (WITs) for arbitrary Controller workloads. A downstream resource server such as HashiCorp Vault that trusts the gateway OIDC key will accept the forged WIT and return the AAP credentials bound to that workload, disclosing secrets beyond the attacker's authorization boundary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-94416
EUVD
EUVD-2026-85867

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
red_hat ansible_automation_platform 2.5
red_hat ansible_automation_platform 2.6
red_hat ansible jewel
redhat ansible_automation_platform *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-94416 is an authorization bypass in the Ansible Automation Platform (AAP) gateway. It allows an authenticated administrator to create a service key for the Controller service cluster that is cryptographically identical to legitimate keys. This forged key can be used to impersonate the Controller service and generate Workload Identity Tokens (WITs) for arbitrary workloads when combined with the OIDC workload-identity endpoint.

Detection Guidance

To detect unauthorized service keys in Ansible Automation Platform (AAP), check for non-installer-provisioned keys using the AAP CLI or API. Look for keys created via the gateway API endpoint /api/gateway/v1/service_keys. Verify if the OIDC workload-identity endpoint (FEATURE_OIDC_WORKLOAD_IDENTITY_ENABLED) is enabled and if any forged Workload Identity Tokens (WITs) were generated. Audit downstream systems like HashiCorp Vault for unexpected credential disclosures.

Impact Analysis

An attacker could use this vulnerability to gain unauthorized access to sensitive credentials such as cloud IAM keys, SSH private keys, or service-account credentials. This could lead to data breaches, privilege escalation, or unauthorized control over systems trusting the AAP gateway's OIDC key.

Compliance Impact

This vulnerability could lead to unauthorized access and disclosure of sensitive data, violating compliance requirements such as GDPR's data protection principles or HIPAA's security rules. Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance resulting from this breach.

Mitigation Strategies

Immediately revoke all non-installer-provisioned service keys in AAP. Disable the OIDC workload-identity endpoint (FEATURE_OIDC_WORKLOAD_IDENTITY_ENABLED) if not required. Rotate any exposed downstream credentials, such as cloud IAM keys or SSH private keys. Upgrade to a patched version of AAP where POST requests to /api/gateway/v1/service_keys return 405 errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94416. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart