CVE-2026-84474

Summary

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret (host_config_key) is exposed to users holding only the read-level view_jobtemplate permission – both in the job template API representation and in the activity stream – and the provisioning callback endpoint trusts a client-supplied X-Forwarded-For header to determine the calling host when the controller is deployed behind the AAP gateway with an empty proxy allow-list. By reading the secret and spoofing X-Forwarded-For to match any host in the job template's inventory, a minimally privileged or unauthenticated remote attacker can launch the job template against arbitrary managed hosts using the job template's credentials, resulting in privilege escalation and remote code execution on managed hosts.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat Ansible Automation Platform 2.4 for RHEL 80:4.5.36-1.el8ap < *unaffected
Red HatRed Hat Ansible Automation Platform 2.4 for RHEL 90:4.5.36-1.el9ap < *unaffected
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 90:4.7.17-1.el9ap < *unaffected

Weaknesses

  • CWE-807: Reliance on Untrusted Inputs in a Security Decision

Workarounds

  • Restrict who holds view_jobtemplate on job templates that have provisioning callback enabled; disable provisioning callback (clear host_config_key) on JTs that do not require it.
  • Set PROXY_IP_ALLOWED_LIST to the AAP gateway/envoy address(es) so untrusted client X-Forwarded-For headers are stripped before host matching.
  • Rotate any host_config_key values that may have been exposed to read-only users; review activity_stream access.
  • Monitor for jobs with launch_type=callback and unexpected limit values or created_by=None.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References