CVE-2026-84712

Summary

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory (node hostnames, node types, UUIDs, heartbeats, capacities, and exact versions), all instance-group names and membership, the deployment install UUID, and the active control node. A remote, unauthenticated attacker can use this to map the control plane and fingerprint software versions for targeted attacks. This flaw affects confidentiality only; it does not expose secrets, credentials, or tenant data.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:4.6.33-1.el8ap < *unaffected
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:4.6.33-1.el9ap < *unaffected
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 90:4.7.17-1.el9ap < *unaffected
Red HatRed Hat Ansible Automation Platform 2.61789673739 < *unaffected
Red HatRed Hat Ansible Automation Platform 2.71789580684 < *unaffected

Weaknesses

  • CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References