Threats Tagged 'cve-2026-84470'

Red Hat Ansible Automation Platform 2.5 for RHEL 9 contains multiple critical security vulnerabilities affecting its automation-controller and related components. These include remote code execution, privilege escalation, information disclosure, denial of service, command injection, cross-tenant data exposure, and other serious flaws. The vulnerabilities impact features such as GitPython integration, workflow job templates, credential handling, Jinja template rendering, and mesh certificate issuance. Red Hat has issued a security advisory with updates to address these issues.

Red Hat Ansible Automation Platform 2.6 contains multiple critical security vulnerabilities affecting its automation-controller, automation-gateway-proxy, and automation-platform-ui components. These vulnerabilities include remote code execution, privilege escalation, information disclosure, denial of service, cross-site scripting, and unauthorized access. Red Hat has released a security update addressing these issues for Ansible Automation Platform 2.6 on RHEL 9 and RHEL 10.

CVE-2026-84470 is a vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8 affecting the automation-controller's Bulk Job Launch API. The API incorrectly authorizes instance groups with only read-level permission instead of the required use-level permission. This allows an authenticated user with read permission on an instance group and execute permission on a job template to launch bulk jobs on instance groups they are not authorized to use, bypassing execution-placement isolation.

A flaw was found in Ansible Automation Platform's automation-controller (AWX). The Bulk Job Launch API (POST /api/v2/bulk/job_launch/) authorizes the requested instance_groups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same field. A principal that holds read (but not use) permission on an instance group -- for example the built-in read-only System Auditor role -- together with execute permission on a job template can launch bulk jobs onto instance groups they are not authorized to use, bypassing execution-placement isolation.