The vulnerability in Ansible Automation Platform automation-controller arises from insufficient permission checks during the copying of WorkflowJobTemplates. The deep-copy permission sanitizer validates only inventory, unified_job_template, and credentials of cloned nodes but neglects to verify instance_groups, execution_environment, and labels. Consequently, a user with workflow-admin permission but lacking roles on referenced instance groups can copy a workflow, become its administrator, and launch jobs on unauthorized instance groups, including the control-plane instance group. This bypasses the InstanceGroup use_role boundary and allows attacker-influenced automation to execute with elevated privileges in the control-plane context.

An attacker with organization workflow-admin permission can escalate privileges by gaining administrative control over copied workflow job templates and execute automation jobs on instance groups they are not authorized to use, including the critical control-plane instance group. This leads to a complete compromise of confidentiality, integrity, and availability of the automation environment, as reflected by the CVSS score of 9.9 (critical).

A security update is available from Red Hat for Ansible Automation Platform 2.6 that addresses this vulnerability. Users should apply the official patch provided in Red Hat Advisory RHSA-2026:71113 to remediate the issue. No additional mitigation steps are necessary once the update is applied.