The vulnerability CVE-2026-6266 affects Red Hat Ansible Automation Platform 2.5 and 2.6. It arises from the user auto-link strategy in the AAP gateway, which links external IDP identities to existing user accounts based solely on email matching without verifying ownership of the email address. This lack of verification enables remote attackers to hijack accounts or gain unauthorized access, including administrative privileges, by manipulating the email attribute provided by the IDP. Red Hat has issued important security advisories (RHSA-2026:13508 for 2.6 and RHSA-2026:13512 for 2.5) that provide patches to fix this issue. The CVSS v3.1 base score is 8.3, reflecting high impact on confidentiality and integrity with low attack complexity and no user interaction required.

Successful exploitation allows remote attackers to bypass authentication controls by exploiting the unverified email linking mechanism, leading to account hijacking and unauthorized access to user accounts, including those with administrative privileges. This compromises confidentiality and integrity of the affected systems. The CVSS score of 8.3 indicates a high severity impact with potential for significant unauthorized access.

Red Hat has released official security updates that fix this vulnerability in Red Hat Ansible Automation Platform versions 2.5 and 2.6. Users should apply the updates provided in advisories RHSA-2026:13508 (for 2.6) and RHSA-2026:13512 (for 2.5) as soon as possible. The vendor advisory is the authoritative source for patching instructions and should be followed closely. No alternative mitigations or workarounds are specified in the advisory.