Search: CVE-2026-84474

A critical vulnerability in Red Hat Ansible Automation Platform's automation-controller allows users with only read-level view_jobtemplate permission to access the provisioning-callback secret (host_config_key). The provisioning callback endpoint trusts a client-supplied X-Forwarded-For header when deployed behind the AAP gateway with an empty proxy allow-list. An attacker can exploit this by reading the secret and spoofing the X-Forwarded-For header to impersonate any host in the job template's inventory, enabling them to launch jobs on arbitrary managed hosts with the job template's credentials. This results in privilege escalation and remote code execution on managed hosts.