Server-Side Request Forgery Vulnerability in Ansible Automation Platform by Red Hat

CVE-2026-84721

What is CVE-2026-84721?

A server-side request forgery flaw exists in the email notification backend of the Ansible Automation Platform. The backend improperly handles user-supplied SMTP host and port details from notification templates, failing to validate that the target address is not internal, loopback, or reserved. An authenticated user with notification-admin access can create or modify templates to point to arbitrary internal addresses. This can trigger a test and lead to a raw TCP connection being established, which can reveal the state of internal ports, including those of the Kubernetes API. Additionally, if a shared notification template holds sensitive SMTP credentials, manipulating the SMTP host can inadvertently transmit these credentials to potentially malicious servers.

References