Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-84719: Ansible Automation Platform lets workflow copy grant unauthorized control
CVE-2026-84719 · published 18 days ago
Summary
In Ansible Automation Platform, copying a workflow job template does not check the groups that run the jobs. A user who can copy a workflow but lacks permission on those groups can end up running jobs on restricted groups, including the core control environment. Review and restrict who can copy workflows, and apply tighter checks on group permissions for copied templates.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| red hat | red hat ansible automation platform 2 | All versions |
| red hat | red hat ansible automation platform 2.4 for rhel 8 | All versions |
| red hat | red hat ansible automation platform 2.4 for rhel 9 | All versions |
| red hat | red hat ansible automation platform 2.6 for rhel 9 | All versions |
| red hat | red hat ansible automation platform 2.5 for rhel 8 | All versions |
| red hat | red hat ansible automation platform 2.5 for rhel 9 | All versions |
| red hat | red hat ansible automation platform 2.6 | All versions |
| red hat | red hat ansible automation platform 2.7 | All versions |
Original advisory text
Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)
A flaw was found in the Ansible Automation Platform automation-controller. When a
WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory,
unified_job_template, and credentials of each cloned node and fails to check the instance_groups
(and execution_environment and labels) that were preserved from the original. A user with
organization workflow-admin permission but no role on the referenced instance groups can copy a
workflow, become its administrator, and launch jobs pinned to instance groups they are not
authorized to use — including the control-plane instance group — bypassing the InstanceGroup
use_role boundary and causing attacker-influenced automation to run in the control-plane
execution context.
WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory,
unified_job_template, and credentials of each cloned node and fails to check the instance_groups
(and execution_environment and labels) that were preserved from the original. A user with
organization workflow-admin permission but no role on the referenced instance groups can copy a
workflow, become its administrator, and launch jobs pinned to instance groups they are not
authorized to use — including the control-plane instance group — bypassing the InstanceGroup
use_role boundary and causing attacker-influenced automation to run in the control-plane
execution context.
References
- https://access.redhat.com/errata/RHSA-2026:71113
- https://access.redhat.com/errata/RHSA-2026:71115
- https://access.redhat.com/security/cve/CVE-2026-84719
- https://bugzilla.redhat.com/show_bug.cgi?id=2527213
- https://access.redhat.com/errata/RHSA-2026:71114
- https://access.redhat.com/errata/RHSA-2026:71177
- https://access.redhat.com/errata/RHSA-2026:71179
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-862Missing Authorization
Timeline
Published23 Sep 2026
Updated11 Oct 2026
First seen23 Sep 2026
Track software like this
Free during beta