CVE-2026-84470: Missing Authorization in Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

The vulnerability exists in the Bulk Job Launch API (POST /api/v2/bulk/job_launch/) of the automation-controller component in Red Hat Ansible Automation Platform 2.6 for RHEL 9. The API incorrectly checks authorization on instance_groups using read-level permission rather than use-level permission as required by the standard single-job launch path. An authenticated principal with read permission on an instance group (e.g., System Auditor role) and execute permission on a job template can exploit this flaw to launch bulk jobs on instance groups they are not authorized to use, bypassing execution-placement isolation. The flaw does not grant new template or credential access but allows unauthorized control over execution placement.

An attacker with read permission on instance groups and execute permission on job templates can bypass execution-placement isolation by launching bulk jobs on unauthorized instance groups. This could lead to unauthorized execution placement, potentially impacting integrity and availability of the automation environment. Confidentiality is not affected. The CVSS v3.1 base score is 6.4 (medium severity) with network attack vector, low complexity, low privileges required, no user interaction, and scope changed.

Red Hat advises restricting the System Auditor role and avoiding combinations of read permission on instance groups with execute permission on job templates. Review custom roles for such permission combinations. Where possible, restrict network or proxy access to the Bulk Job Launch API endpoint (/api/v2/bulk/job_launch/) to trusted automation callers until a fix is applied. Additionally, audit workflow and bulk jobs for execution placement on instance groups where the launching principal lacks use-level permission. Check the Red Hat advisory for updates on official fixes or patches.