The vulnerability exists because four debug views in the automation-controller are routed in production builds without gating on the debug setting, allowing any user including unauthenticated clients to invoke them. By repeatedly triggering these endpoints, an attacker can acquire the cluster-wide scheduler advisory lock, which the legitimate scheduler acquires without waiting. This leads to skipped scheduler runs and stalls job dispatch across all tenants, while also consuming controller web workers. Furthermore, the debug root view discloses the list of debug endpoints to unauthenticated callers. The fix restricts these endpoints to system administrators and only routes them when debug mode is enabled.

An unauthenticated remote attacker can cause a denial of service by preventing legitimate scheduler runs, stalling job dispatch for all tenants of the automation platform. The attacker also consumes controller web workers, potentially degrading controller performance. Additionally, the debug root view leaks information about debug endpoints to unauthenticated users, which may aid further attacks. There is no direct impact on integrity, but confidentiality is low due to information disclosure, and availability impact is high.

A fix is available that restricts the debug endpoints to system administrators and ensures they are only routed when debug mode is enabled. Users should apply the official update from Red Hat Ansible Automation Platform that implements this fix. Until patched, restricting access to the automation-controller debug endpoints and disabling debug mode in production environments can mitigate exploitation risk.