CVE-2026-84718 describes a flaw in the Ansible Automation Platform automation-controller where the system trusts the client-supplied X-Forwarded-For HTTP header as the client's IP address without verifying that the header originated from a trusted proxy. The controller selects the leftmost value of this header, which can be attacker-controlled, allowing an attacker to falsify the source IP address recorded in audit and access logs. This compromises the integrity of forensic and security information and event management (SIEM) data but does not provide the attacker with elevated privileges or additional access.

The vulnerability allows attackers to manipulate the source IP address recorded in audit and access logs, undermining the reliability of forensic investigations and SIEM systems that rely on accurate IP attribution. However, it does not enable unauthorized access or privilege escalation.

An official fix is available as per the Red Hat advisory RHSA-2026:71113. Users should apply the update to Red Hat Ansible Automation Platform 2.6 or later as provided by Red Hat to remediate this issue. No additional mitigation steps are required beyond applying the vendor's patch.