Red Hat Ansible Automation Platform 2.4 contains several critical security flaws in the automation-controller, including privilege escalation via provisioning-callback host-match bypass (CVE-2026-84474), instance-group privilege escalation via workflow job template copy (CVE-2026-84719), arbitrary file read through Project scm_branch git argument injection (CVE-2026-84711), privilege escalation via constructed inventory attachment (CVE-2026-84684), instance-group privilege escalation via schedule and workflow node attachment (CVE-2026-84638), remote code execution via Project scm_url git argument injection (CVE-2026-84502), privilege escalation to OpenShift namespace via pod_spec_override injection (CVE-2026-75884), and Kubernetes service account token exfiltration via HashiCorp Vault credential SSRF (CVE-2026-12564). These vulnerabilities allow attackers to escalate privileges, read arbitrary files, execute code remotely, and exfiltrate sensitive tokens. Red Hat has issued a critical security advisory (RHSA-2026:71115) with fixes for these issues in Ansible Automation Platform 2.4 for multiple RHEL architectures.

The vulnerabilities allow attackers to escalate privileges within the automation-controller, read arbitrary sensitive files including credentials, execute arbitrary code remotely on controller pods, and exfiltrate Kubernetes service account tokens via SSRF attacks. This can lead to unauthorized control over automation workflows, compromise of sensitive data, and potential further compromise of the underlying infrastructure and OpenShift namespaces.

Red Hat has released an official security update for Ansible Automation Platform 2.4 addressing these vulnerabilities. Users should apply the update as documented in the Red Hat advisory RHSA-2026:71115 and the Ansible Automation Platform 2.4 release notes. No additional mitigation steps are required beyond applying the official fix.