The automation-controller's install-bundle endpoint signs X.509 certificates using the receptor mesh certificate authority, embedding the caller-chosen instance hostname verbatim in the certificate's Common Name, DNS subject-alternative-name, and receptor node-id fields. The hostname charset validator is case-insensitive, but the uniqueness validator is case-sensitive, allowing an administrator to register a case variant of an existing control node's hostname and receive a mesh-CA-signed certificate accepted by TLS peers that perform case-insensitive hostname matching. The certificates have a hard-coded ten-year validity, random serial numbers, and no issuance log or revocation list. In managed or hosted deployments where the customer holds controller superuser privileges but the platform operator runs the mesh, this flaw can yield long-lived, non-revocable mesh peer credentials, enabling TLS impersonation or interception of control or hybrid mesh nodes. The vulnerability does not grant remote code execution because receptor work submission requires a separate signing key not included in the bundle.

An attacker with system administrator privileges can obtain a mesh-CA-signed certificate for a hostname variant that TLS peers accept as a legitimate control node, enabling TLS impersonation or interception within the mesh network. This can compromise confidentiality and integrity of communications between mesh nodes in managed or hosted deployments. However, it does not allow direct remote code execution or unauthorized job submission.

A security update is available from Red Hat as part of the Red Hat Ansible Automation Platform 2.6 update (RHSA-2026:71113) that addresses this vulnerability. Users should apply the official patch provided by Red Hat to remediate this issue. No additional mitigation steps are required beyond applying the vendor's fix.