Search: CVE-2026-94416

CVE-2026-94416 is an authorization bypass vulnerability in Red Hat Ansible Automation Platform 2.6 for RHEL 9. It allows an authenticated administrator to create a service key indistinguishable from a legitimate one, enabling forging of service-authentication tokens. This can be exploited to impersonate the Controller service and, combined with the gateway OIDC workload-identity endpoint, to sign Workload Identity Tokens for arbitrary workloads. Downstream resource servers trusting the gateway OIDC key may accept these forged tokens and disclose credentials beyond the attacker's authorization boundary. Red Hat has released an important security update addressing this issue.