API Over-Serialization Flaw in Automation-Controller by Red Hat
CVE-2026-84712

5.3MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Ansible Automation Platform 2.5 For Rhel 8
Red Hat Ansible Automation Platform 2.5 For Rhel 9
Red Hat Ansible Automation Platform 2.6 For Rhel 9
Red Hat Ansible Automation Platform 2.6
Vendor
CVE Published:
23 September 2026

What is CVE-2026-84712?

A flaw in the automation-controller API allows unauthenticated access to the health-check endpoint /api/v2/ping/. This endpoint over-serializes Role-Based Access Control (RBAC)-gated data, potentially allowing attackers to gather sensitive details about the system's instance inventory, including node hostnames, types, UUIDs, capacities, and software versions. Such exposure could enable unauthorized mapping of the control plane, facilitating targeted attack strategies without revealing secrets, credentials, or tenant data.

Affected Version(s)

Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:4.6.33-1.el8ap

Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:4.6.33-1.el9ap

Red Hat Ansible Automation Platform 2.6 1789673739

References

https://access.redhat.com/errata/RHSA-2026:71113
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:71114
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:71177
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.