Security Flaw in Automation-Controller from Red Hat

CVE-2026-84716

What is CVE-2026-84716?

A vulnerability in Red Hat's automation-controller involves improper handling of the install-bundle endpoint, where it incorrectly signs X.509 certificates based on a system administrator's chosen instance hostname. This leads to the potential for certificate impersonation, as the validation process for hostnames is case-insensitive while uniqueness checks are case-sensitive. This flaw allows an administrator to register a case variant of a control node's hostname, enabling unauthorized access to a mesh peer credential that could facilitate TLS impersonation or interception in hosted deployments. Although it does not provide direct remote code execution, it significantly increases security risks within controlled environments.

References