Flaw in Schedule Automation of Automation Controller by Red Hat
CVE-2026-125063
What is CVE-2026-125063?
A significant flaw exists in the rrule validation process within Red Hat's Automation Controller. The vulnerability arises from the use of non-anchored regular expressions with lazy wildcard prefixes, leading to performance issues when validating user-supplied rrule values in the absence of expected DTSTART/RRULE tokens. Authenticated users can exploit this flaw by sending large, token-free rrule values through the REST API, including the schedule preview endpoint, which does not require stringent resource-level permissions. This causes the validation process to take longer, as it runs synchronously in the API web worker. Consequently, such requests can monopolize the web worker for extended durations, potentially exhausting the available web worker pool and resulting in a denial of access to both the API and web UI for other legitimate users during the attack.