CVE-2026-84721 is an SSRF vulnerability in the Ansible Automation Platform automation-controller email notification backend. The backend uses user-supplied SMTP host and port values directly without validating whether the target is internal or reserved. An authenticated user with organization notification-admin permission can create or modify email notification templates to point to arbitrary internal addresses and trigger test notifications. This causes the controller task process to open raw TCP connections to those addresses, reflecting connection errors back through notification records. This behavior provides a three-state internal port scanning oracle (open, closed, filtered) over the control-plane cluster network, including the in-cluster Kubernetes API. Additionally, if a shared organization template stores an SMTP password, redirecting the host can cause that credential to be sent to an attacker-controlled server. The vulnerability is due to missing validation of connect targets in the email backend, unlike other notification backends which have been hardened. The correct fix involves validating and rejecting private, loopback, link-local, and reserved destinations for all notification backends. Red Hat notes that this validation currently exists only on the 2.7 branch and should be applied broadly.

An authenticated user with notification-admin permissions can perform internal network port scanning via the automation-controller, potentially mapping internal services including the Kubernetes API. This SSRF flaw can also lead to the exfiltration of stored SMTP credentials if shared templates with passwords are redirected to attacker-controlled servers. The vulnerability impacts confidentiality and integrity but does not affect availability. The CVSS v3.1 score is 6.4 (medium severity) with network attack vector, low complexity, low privileges required, no user interaction, and scope changed.

Red Hat has identified this vulnerability and notes that the correct fix is to validate SMTP host and port targets for all notification backends, rejecting internal, loopback, link-local, and reserved addresses. This validation currently exists only on the 2.7 branch of the automation-controller. Users should monitor Red Hat advisories for official patches or updates that implement this validation across all supported versions. Until a fix is available, restrict notification-admin permissions to trusted users and avoid storing SMTP credentials in shared templates. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.