The vulnerability in Red Hat Ansible Automation Platform 2's automation-controller arises because the Bitbucket Data Center webhook receiver bypasses HMAC signature verification for diagnostics:ping events after it has already looked up the target template. This results in the endpoint returning HTTP 200 if a template has a Bitbucket DC webhook configured and HTTP 403 otherwise. An unauthenticated remote attacker can exploit this observable response discrepancy as an oracle to enumerate which Job Template and Workflow Job Template IDs have Bitbucket DC webhooks configured, without needing the secret webhook_key. The issue is limited to information disclosure about the existence and webhook configuration of template IDs. The recommended fix involves making the unsigned diagnostics:ping response independent of template existence or requiring a valid X-Hub-Signature for ping events.

The impact is limited to confidentiality, specifically the ability for an unauthenticated attacker to enumerate which job templates have Bitbucket Data Center webhooks configured. No secret webhook keys, credentials, or payload contents are disclosed. Integrity and availability are not affected by this vulnerability.

Red Hat's advisory indicates the correct fix is to make the unsigned diagnostics:ping response independent of whether a matching template exists or to require a valid X-Hub-Signature for ping events. Patch status is not explicitly stated in the advisory content provided. Therefore, patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-84717 for current remediation guidance. Until a fix is applied, be aware of the information disclosure risk from response discrepancies.