The vulnerability exists in the automation-controller instance install-bundle endpoint of Red Hat Ansible Automation Platform 2. When a system administrator downloads an execution or hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority. The certificate's Common Name, DNS subject-alternative-name, and receptor node-id are taken verbatim from the caller-chosen instance hostname, with a hard-coded ten-year validity, a random serial number, and no issuance log or revocation list. The hostname charset validator is case-insensitive, but the uniqueness validator is case-sensitive, allowing an administrator to register a case variant of an existing control node's hostname and obtain a mesh-CA-signed certificate that TLS peers accept as that control node. In managed or hosted deployments where the customer holds controller superuser but the platform operator runs the mesh, this results in a long-lived, non-revocable mesh peer credential that can be used for TLS impersonation or interception of control or hybrid mesh nodes. The vulnerability does not grant direct remote code execution because receptor work submission requires a separate signing key not included in the bundle.

The vulnerability allows a user with system administrator privileges to impersonate or intercept TLS communications of control or hybrid mesh nodes by obtaining a long-lived, non-revocable certificate for a case-variant hostname. This can lead to confidentiality breaches through TLS impersonation or interception. However, it does not allow direct remote code execution or unauthorized work submission, as those require separate signing keys.

Red Hat has published an advisory for this vulnerability. The advisory does not explicitly state that a fix is available or provide patch links, so patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-84716 for current remediation guidance. Until a fix is available, administrators should be aware of the risk of registering case-variant hostnames and consider operational mitigations to prevent unauthorized certificate issuance. No generic or unrelated mitigations are recommended.