CVE-2026-84486 is a vulnerability in Red Hat Ansible Automation Platform's automation-controller where four debug views that trigger internal schedulers are accessible to any user, including unauthenticated clients. These debug endpoints are routed in production builds without gating on the debug setting. An attacker can repeatedly invoke these endpoints to acquire the cluster-wide scheduler advisory lock, causing legitimate scheduler runs to be skipped and stalling job dispatch cluster-wide while consuming controller web workers. The debug root view also discloses the list of debug endpoints to unauthenticated callers.

An unauthenticated remote attacker can cause denial of service by stalling job dispatch for all tenants in the Ansible Automation Platform cluster. The attacker achieves this by acquiring a scheduler advisory lock that prevents legitimate scheduler runs from proceeding. Additionally, sensitive information about debug endpoints is disclosed to unauthenticated users, which may aid further attacks.

An official security update is available from Red Hat as detailed in RHSA-2026:71113. Users should apply the update to Red Hat Ansible Automation Platform 2.6 to remediate this vulnerability. No additional mitigation is required once the update is applied.