The vulnerability exists because the automation-controller in Red Hat Ansible Automation Platform 2, in its default production configuration, trusts the leftmost value of the client-supplied X-Forwarded-For header as the client IP without verifying that the request came from a trusted proxy. This enables an attacker to forge the source IP address recorded in audit and access logs, degrading the integrity of forensic and SIEM attribution. The issue is limited to log integrity and does not provide additional access or disclose information. A robust fix involves using the trusted-proxy shared-secret mechanism to prefer the rightmost trusted entry or selecting the rightmost entry rather than the leftmost. Merely populating PROXY_IP_ALLOWED_LIST does not fully resolve the issue in some deployment scenarios.

The impact is limited to the integrity of audit and access logs where the source IP address can be spoofed by an attacker. This undermines forensic investigations and SIEM attribution but does not affect confidentiality, availability, or grant any additional privileges or access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor advisory notes that merely setting PROXY_IP_ALLOWED_LIST is insufficient in some deployments. The recommended fix is to use the trusted-proxy shared-secret mechanism to prefer the trusted rightmost X-Forwarded-For entry or to select the rightmost entry rather than the leftmost. Monitor Red Hat's advisory page for updates and apply official fixes when available.