The automation-controller API has an unauthenticated endpoint (/api/v2/ping/) that returns over-serialized RBAC-protected automation-mesh data in its anonymous response. This data includes comprehensive instance inventory details such as node hostnames, types, UUIDs, heartbeats, capacities, exact software versions, instance-group names and memberships, deployment install UUID, and the active control node. The vulnerability allows remote unauthenticated attackers to map the control plane and fingerprint software versions, affecting confidentiality but not exposing secrets, credentials, or tenant data.

The vulnerability impacts confidentiality by exposing detailed infrastructure and software version information to unauthenticated remote attackers. This information disclosure can facilitate targeted attacks by enabling attackers to map the control plane and identify software versions in use. However, it does not expose sensitive secrets, credentials, or tenant-specific data, limiting the scope of impact to information disclosure only.

A security update addressing this vulnerability is available as part of the Red Hat Ansible Automation Platform 2.6 update (RHSA-2026:71113). Users should apply this official fix to remediate the issue. No additional mitigation steps are required beyond applying the vendor-provided patch.