Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-84719— Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)

Quick assessment

Affected

Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Ansible Automation Platform 的 automation-controller 中发现了一个缺陷。当 WorkflowJobTemplate（工作流作业模板）被复制时，深层复制权限校验器仅验证每个克隆节点的 inventory（库存）、unified_job_template（统一作业模板）和 credentials（凭据），但未检查从原模板中保留的 instance_groups（实例组）、execution_environment（执行环境）和 labels（标签）。因此，拥有组织级

CVSS 9.9 · Critical EPSS 0.43% · P35 Updated Sep 28, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of each cloned node and fails to check the instance_groups (and execution_environment and labels) that were preserved from the original. A user with organization workflow-admin permission but no role on the referenced instance groups can copy a workflow, become its administrator, and launch jobs pinned to instance groups they are not authorized to use — including the control-plane instance group — bypassing the InstanceGroup use_role boundary and causing attacker-influenced automation to run in the control-plane execution context.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
Red Hat	Red Hat Ansible Automation Platform 2.4 for RHEL 8	0:4.5.36-1.el8ap ~ *	`cpe:/a:redhat:ansible_automation_platform:2.4::el8`
Red Hat	Red Hat Ansible Automation Platform 2.4 for RHEL 9	0:4.5.36-1.el9ap ~ *	`cpe:/a:redhat:ansible_automation_platform:2.4::el8`
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	0:4.6.33-1.el8ap ~ *	`cpe:/a:redhat:ansible_automation_platform:2.5::el8`
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 9	0:4.6.33-1.el9ap ~ *	`cpe:/a:redhat:ansible_automation_platform:2.5::el8`
Red Hat	Red Hat Ansible Automation Platform 2.6 for RHEL 9	0:4.7.17-1.el9ap ~ *	`cpe:/a:redhat:ansible_automation_platform:2.6::el10`
Red Hat	Red Hat Ansible Automation Platform 2.6	1789673739 ~ *	`cpe:/a:redhat:ansible_automation_platform:2.6::el9`
Red Hat	Red Hat Ansible Automation Platform 2.7	1789580684 ~ *	`cpe:/a:redhat:ansible_automation_platform:2.7::el9`

II. Public POCs for CVE-2026-84719

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-84719

请登录查看更多情报信息。

Other References for CVE-2026-84719 (7)

https://access.redhat.com/security/cve/CVE-2026-84719 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2527213 issue-tracking x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:71113 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:71179 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:71177 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:71115 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:71114 vendor-advisory x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-84719

Same Patch Batch · Red Hat · 2026-09-23 · 46 CVEs total

CVE-2026-84474	9.9 CRITICAL	Automation-controller: automation-controller-container: automation-controller: view_jobtem
CVE-2026-84502	9.9 CRITICAL	Automation-controller: automation-controller-container: automation-controller: project scm
CVE-2026-75884	9.1 CRITICAL	Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in c
CVE-2026-96275	8.8 HIGH	Flatpak: flatpak: arbitrary write access as root via extra-data extraction
CVE-2026-84683	8.7 HIGH	Automation-controller: automation-controller-container: automation-controller: stored cros
CVE-2026-84691	8.7 HIGH	Automation-controller: automation-controller-container: automation-controller: format stri
CVE-2026-76648	8.5 HIGH	Automation-controller: automation-controller-container: aap controller: copyapiview.post()
CVE-2026-84486	8.2 HIGH	Automation-controller: automation-controller-container: automation-controller: unauthentic
CVE-2026-96512	7.8 HIGH	Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authori
CVE-2026-96889	7.8 HIGH	Librsvg: use-after-free when xml includes have duplicated entities
CVE-2026-84499	7.7 HIGH	Automation-controller: automation-controller-container: automation-controller: write-only
CVE-2026-84706	7.6 HIGH	Automation-controller: automation-controller-container: automation-controller: credential
CVE-2026-96541	7.5 HIGH	Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake d
CVE-2026-75887	7.5 HIGH	Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handle
CVE-2026-88830	7.5 HIGH	Busybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pr
CVE-2026-88832	7.3 HIGH	Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label
CVE-2026-85475	7.2 HIGH	Automation-controller: automation-controller-container: automation-controller: rsyslog con
CVE-2026-75886	7.2 HIGH	Openshift/console: openshift/console: unauthenticated reverse proxy to in-cluster catalogd
CVE-2026-84714	7.1 HIGH	Automation-controller: automation-controller: incomplete sanitize_jinja() regex allows jin
CVE-2026-96445	6.8 MEDIUM	Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against

Showing top 20 of 46 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Red Hat Ansible Automation Platform 2.4 for RHEL 8

Same vendor: Red Hat

Same weakness: CWE-862

V. Comments for CVE-2026-84719

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-84719— Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)

Quick assessment

I. Basic Information for CVE-2026-84719

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-84719

III. Intelligence Information for CVE-2026-84719

Other References for CVE-2026-84719 (7)

Same Patch Batch · Red Hat · 2026-09-23 · 46 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-84719

Leave a comment