CVE-2026-84470: Missing Authorization in Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

The Bulk Job Launch API (POST /api/v2/bulk/job_launch/) in Red Hat Ansible Automation Platform's automation-controller (AWX) performs authorization checks on instance_groups using only read-level permission. In contrast, the standard single-job launch path requires use-level permission. This discrepancy allows a principal with read (but not use) permission on an instance group, such as the System Auditor role, combined with execute permission on a job template, to launch bulk jobs on unauthorized instance groups. This bypasses execution-placement isolation but does not grant new template or credential access.

An authenticated user with execute permission on a job template and read permission on an instance group can bypass intended execution-placement restrictions and run bulk jobs on instance groups they are not authorized to use. This could lead to unauthorized job execution placement, potentially impacting system integrity and availability. The vulnerability does not allow escalation of template or credential access and does not affect confidentiality.

Red Hat advises restricting the System Auditor role and avoiding combining it with job-template execute permissions. Review custom roles that grant read on instance groups alongside execute on job templates. Where possible, restrict network or proxy access to the Bulk Job Launch API endpoint (/api/v2/bulk/job_launch/) to trusted automation callers until a fix is applied. Additionally, audit workflow and bulk jobs for unauthorized placement on instance groups. Check the Red Hat advisory for updates on official patches or fixes.