A flaw in the automation-controller API of Red Hat Ansible Automation Platform 2 causes the unauthenticated health-check endpoint /api/v2/ping/ to over-serialize RBAC-gated automation-mesh data into its anonymous response. This results in exposure of the full instance inventory (including node hostnames, types, UUIDs, heartbeats, capacities, exact versions), all instance-group names and memberships, the deployment install UUID, and the active control node. An unauthenticated remote attacker can leverage this information to map the control plane and fingerprint software versions for targeted attacks. The vulnerability impacts confidentiality but does not expose secrets, credentials, or tenant data.

The vulnerability exposes sensitive system information related to the automation mesh topology and instance-group membership to unauthenticated remote attackers. This information disclosure can aid attackers in mapping the control plane and fingerprinting software versions, potentially facilitating targeted attacks. However, it does not compromise secrets, credentials, or tenant data, limiting the impact to confidentiality only.

There is no configuration workaround to trim the /api/v2/ping/ response. Operators should reduce exposure by ensuring that the Controller API route is not reachable from untrusted networks and by fronting health checks with an infrastructure probe that does not proxy /ping/ externally. The definitive fix is to stop serializing instance, instance-group, install UUID, and active node data from the unauthenticated endpoint. Check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-84712 for updates on patch availability and remediation guidance.