Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-84474: Red Hat Ansible Automation Platform can run jobs with read‑only users
CVE-2026-84474 · published 18 days ago
Summary
In Red Hat Ansible Automation Platform, a secret used for provisioning callbacks is shown to users who only have permission to view job templates. Because the system trusts a client-supplied header, an attacker who can read this secret can pretend to be an allowed host and trigger the job template, giving them the ability to run commands on managed machines. Update to the latest patches for the listed versions or restrict the proxy allow‑list and header handling to stop this behavior.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| red hat | red hat ansible automation platform 2.4 for rhel 8 | All versions |
| red hat | red hat ansible automation platform 2.4 for rhel 9 | All versions |
| red hat | red hat ansible automation platform 2 | All versions |
| red hat | red hat ansible automation platform 2.6 for rhel 9 | All versions |
| red hat | red hat ansible automation platform 2.5 for rhel 8 | All versions |
| red hat | red hat ansible automation platform 2.5 for rhel 9 | All versions |
| red hat | red hat ansible automation platform 2.6 | All versions |
| red hat | red hat ansible automation platform 2.7 | All versions |
Original advisory text
Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioning-callback host match
A flaw was found in Red Hat Ansible Automation Platform's automation-
controller. The provisioning-callback secret (host_config_key) is exposed to
users holding only the read-level view_jobtemplate permission -- both in the
job template API representation and in the activity stream -- and the
provisioning callback endpoint trusts a client-supplied X-Forwarded-For
header to determine the calling host when the controller is deployed behind
the AAP gateway with an empty proxy allow-list. By reading the secret and
spoofing X-Forwarded-For to match any host in the job template's inventory, a
minimally privileged or unauthenticated remote attacker can launch the job
template against arbitrary managed hosts using the job template's credentials,
resulting in privilege escalation and remote code execution on managed hosts.
controller. The provisioning-callback secret (host_config_key) is exposed to
users holding only the read-level view_jobtemplate permission -- both in the
job template API representation and in the activity stream -- and the
provisioning callback endpoint trusts a client-supplied X-Forwarded-For
header to determine the calling host when the controller is deployed behind
the AAP gateway with an empty proxy allow-list. By reading the secret and
spoofing X-Forwarded-For to match any host in the job template's inventory, a
minimally privileged or unauthenticated remote attacker can launch the job
template against arbitrary managed hosts using the job template's credentials,
resulting in privilege escalation and remote code execution on managed hosts.
References
- https://access.redhat.com/security/cve/CVE-2026-84474
- https://bugzilla.redhat.com/show_bug.cgi?id=2527073
- https://access.redhat.com/errata/RHSA-2026:71113
- https://access.redhat.com/errata/RHSA-2026:71115
- https://access.redhat.com/errata/RHSA-2026:71114
- https://access.redhat.com/errata/RHSA-2026:71177
- https://access.redhat.com/errata/RHSA-2026:71179
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-807Reliance on Untrusted Inputs in a Security Decision
Timeline
Published23 Sep 2026
Updated11 Oct 2026
First seen23 Sep 2026
Track software like this
Free during beta