The vulnerability in Red Hat Ansible Automation Platform's automation-controller involves exposure of the provisioning-callback secret to users with read-level view_jobtemplate permission, visible in the job template API and activity stream. The controller also trusts the X-Forwarded-For header from clients when behind the AAP gateway with an empty proxy allow-list. By exploiting these issues, an attacker can read the secret and spoof the X-Forwarded-For header to impersonate any host in the job template's inventory, enabling execution of job templates on arbitrary managed hosts with the job template's credentials. This leads to privilege escalation and remote code execution on those hosts. The vulnerability has a CVSS 3.1 score of 9.9 (critical). Red Hat has issued an official security advisory (RHSA-2026:71113) with a fix available in Red Hat Ansible Automation Platform 2.6.

An attacker with minimal privileges or no authentication can obtain sensitive secrets and exploit trust in the X-Forwarded-For header to execute arbitrary jobs on managed hosts. This results in privilege escalation and remote code execution, compromising the confidentiality, integrity, and availability of affected systems.

Red Hat has released an official security update for Red Hat Ansible Automation Platform 2.6 addressing this vulnerability. Users should apply the update as detailed in Red Hat Advisory RHSA-2026:71113. No additional mitigation steps are required beyond applying the official fix.