The vulnerability CVE-2026-6266 affects Red Hat Ansible Automation Platform versions 2.5 and 2.6. It arises from the user auto-link strategy in the AAP gateway, which links external IDP identities to existing user accounts based solely on email matching without verifying ownership of the email address. This lack of verification enables remote attackers to hijack accounts or gain unauthorized access, including administrative accounts, by supplying a manipulated email identity from the IDP. Red Hat has issued security advisories RHSA-2026:13508 and RHSA-2026:13512 detailing the issue and providing patches. The vulnerability is rated with a CVSS 3.1 base score of 8.3, indicating high impact on confidentiality and integrity with low attack complexity and no user interaction required. The vendor advisories include updated packages and instructions for remediation.

Successful exploitation of this vulnerability allows remote attackers to hijack user accounts or gain unauthorized access to other accounts, including those with administrative privileges, by exploiting the unverified email linking mechanism in the Ansible Automation Platform. This compromises confidentiality and integrity of the affected systems. The CVSS score of 8.3 reflects high impact on confidentiality and integrity, with low attack complexity and no need for user interaction.

Red Hat has released official security updates for Ansible Automation Platform versions 2.5 and 2.6 that address CVE-2026-6266. Users should apply these patches promptly following the vendor's documentation and guidance. The vendor advisories RHSA-2026:13508 and RHSA-2026:13512 provide detailed instructions on updating affected packages. No additional mitigation is required beyond applying the official fixes.