CVE-2026-84719
Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)
A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of each cloned node and fails to check the instance_groups (and execution_environment and labels) that were preserved from the original. A user with organization workflow-admin permission but no role on the referenced instance groups can copy a workflow, become its administrator, and launch jobs pinned to instance groups they are not authorized to use — including the control-plane instance group — bypassing the InstanceGroup use_role boundary and causing attacker-influenced automation to run in the control-plane execution context.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)
A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of each cloned node and fails to check the instance_groups (and execution_environment and labels) that were preserved from the original. A user with organization workflow-admin permission but no role on the referenced instance groups can copy a workflow, become its administrator, and launch jobs pinned to instance groups they are not authorized to use — including the control-plane instance group — bypassing the InstanceGroup use_role boundary and causing attacker-influenced automation to run in the control-plane execution context.
- Record
CVE-2026-84719- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2026-85606
A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of each cloned node and fails to check the instance_groups (and execution_environment and labels) that were preserved from the original. A user with organization workflow-admin permission but no role on the referenced instance groups can copy a workflow, become its administrator, and launch jobs pinned to instance groups they are not authorized to use — including the control-plane instance group — bypassing the InstanceGroup use_role boundary and causing attacker-influenced automation to run in the control-plane execution context.
- Record
EUVD-2026-85606- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9fg4-x49f-5hhc
A flaw was found in the Ansible Automation Platform automation-controller. When a...
A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of each cloned node and fails to check the instance_groups (and execution_environment and labels) that were preserved from the original. A user with organization workflow-admin permission but no role on the referenced instance groups can copy a workflow, become its administrator, and launch jobs pinned to instance groups they are not authorized to use — including the control-plane instance group — bypassing the InstanceGroup use_role boundary and causing attacker-influenced automation to run in the control-plane execution context.
- Record
GHSA-9fg4-x49f-5hhc- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-862
- Updated
- 2026-11-02
NVD
A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of each cloned node and fails to check the instance_groups (and execution_environment and labels) that were preserved from the original. A user with organization workflow-admin permission but no role on the referenced instance groups can copy a workflow, become its administrator, and launch jobs pinned to instance groups they are not authorized to use — including the control-plane instance group — bypassing the InstanceGroup use_role boundary and causing attacker-influenced automation to run in the control-plane execution context.
- Record
CVE-2026-84719- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-862
- Updated
- 2026-11-05
OSVRHSA-2026:71113
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Record
RHSA-2026:71113- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:71114
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Record
RHSA-2026:71114- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:71115
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Record
RHSA-2026:71115- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
- red hat ansible automation platform 2.4 for rhel 8
- red hat ansible automation platform 2.4 for rhel 9
- red hat ansible automation platform 2.5 for rhel 8
- red hat ansible automation platform 2.5 for rhel 9
- red hat ansible automation platform 2.6
- red hat ansible automation platform 2.6 for rhel 9
- red hat ansible automation platform 2.7
Affected packages
| Package | Affected | Fixed |
|---|---|---|
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
receptorRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el10ap | 0:1.6.8-1.el10ap |
receptorRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:2.6.17-3.el9ap | 0:2.6.17-3.el9ap |
receptorRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
python-sqlparseRed Hat:ansible_automation_platform_developer:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
python3-sqlparseRed Hat:ansible_automation_platform_developer:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
python-sqlparseRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
python3-sqlparseRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
Show 30 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python3.12-sqlparseRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
python3.12-sqlparseRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
automation-platform-uiRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:2.6.14-1.el9ap | 0:2.6.14-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-serverRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-uiRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
python3.12-gitpythonRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:3.1.60-1.el9ap | 0:3.1.60-1.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:4.6.33-1.el8ap | 0:4.6.33-1.el8ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:4.6.33-1.el9ap | 0:4.6.33-1.el9ap |
receptorRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el8ap | 0:1.6.8-1.el8ap |
receptorRed Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el8ap | 0:1.6.8-1.el8ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:2.5.10-8.el8ap | 0:2.5.10-8.el8ap |
receptorRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el8ap | 0:1.6.8-1.el8ap |
receptorRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:2.6.17-3.el9ap | 0:2.6.17-3.el9ap |
receptorRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
python3.12-sqlparseRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 57 CVEs |
before 0:0.6.0-1.el8ap | 0:0.6.0-1.el8ap |
python3.12-sqlparseRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:0.6.0-1.el8ap | 0:0.6.0-1.el8ap |
python3.12-sqlparseRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 57 CVEs |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
python3.12-sqlparseRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
automation-gateway-serverRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:2.5.20260923-1.el8ap | 0:2.5.20260923-1.el8ap |
automation-gateway-serverRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:2.5.20260923-1.el9ap | 0:2.5.20260923-1.el9ap |
python3.12-gitpythonRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:3.1.60-1.el8ap | 0:3.1.60-1.el8ap |
python3.12-gitpythonRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:3.1.60-1.el9ap | 0:3.1.60-1.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 8 CVEs |
before 0:4.5.36-1.el8ap | 0:4.5.36-1.el8ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 8 CVEs |
before 0:4.5.36-1.el9ap | 0:4.5.36-1.el9ap |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| facts | NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-84719 is a critical vulnerability (CVSS 9.9) in Red Hat Ansible Automation Platform 2.4 For Rhel 8, published September 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. No source names a fixed version.
References
access.redhat.com/errata/RHSA-2026:71113
Show 194 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2527213
nvd.nist.gov/vuln/detail/CVE-2026-84719
github.com/advisories/GHSA-9fg4-x49f-5hhc
docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71113.json
cve.org/CVERecord?id=CVE-2026-12564
go.dev/cl/814980
groups.google.com/g/golang-announce/c/94pEornpRlI
pkg.go.dev/vuln/GO-2026-5972
vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module
Left out here: 140 references. The JSON record has them.