The vulnerability in Red Hat Ansible Automation Platform 2 automation-controller involves insufficient authorization checks during the deep-copy operation of WorkflowJobTemplates. Specifically, the sanitizer validates only inventory, unified_job_template, and credentials, but omits checks on instance_groups, execution_environment, and labels preserved from the original workflow. Consequently, a user with organization workflow-admin permission but lacking roles on referenced instance groups can copy a workflow, become its administrator, and execute jobs pinned to unauthorized instance groups, including the critical control-plane instance group. This results in bypassing the InstanceGroup use_role boundary and allows attacker-influenced automation to run with elevated privileges in the control-plane execution context. The flaw is classified as CWE-862 (Missing Authorization) and has a CVSS v3.1 score of 9.9, indicating critical severity.

An attacker with workflow-admin permission but no role on certain instance groups can escalate privileges by copying workflows and launching jobs on instance groups they are unauthorized to use, including the control-plane instance group. This leads to unauthorized code execution in a highly privileged execution context, compromising confidentiality, integrity, and availability of the automation platform. The vulnerability allows bypassing of access controls designed to restrict instance group usage, potentially enabling full control over automation tasks and underlying infrastructure.

Red Hat has acknowledged the vulnerability and provided an advisory. The fix involves adding per-relationship authorization checks for instance_groups, execution_environment, and labels during the deep-copy operation or removing these fields from the copy process. Users should monitor the Red Hat advisory for official patches and apply them once available. Until a fix is deployed, restrict workflow-admin permissions to trusted users only to minimize risk. Patch status is not yet confirmed; check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-84719 for current remediation guidance.