CVE-2026-84638

{}

{}

{}

{"affected_release": [{"advisory": "RHSA-2026:71115", "cpe": "cpe:/a:redhat:ansible_automation_platform:2.4::el8", "package": "automation-controller-0:4.5.36-1.el8ap", "product_name": "Red Hat Ansible Automation Platform 2.4 for RHEL 8", "release_date": "2026-09-23T00:00:00Z"}, {"advisory": "RHSA-2026:71115", "cpe": "cpe:/a:redhat:ansible_automation_platform:2.4::el9", "package": "automation-controller-0:4.5.36-1.el9ap", "product_name": "Red Hat Ansible Automation Platform 2.4 for RHEL 9", "release_date": "2026-09-23T00:00:00Z"}, {"advisory": "RHSA-2026:71113", "cpe": "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "package": "automation-controller-0:4.7.17-1.el9ap", "product_name": "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "release_date": "2026-09-23T00:00:00Z"}], "bugzilla": {"description": "automation-controller: automation-controller-container: automation-controller: instance group attachment to schedules and workflow job template nodes checks only read permission, allowing use of restricted (controlplane / other-tenant) instance groups and privilege escalation to control-plane code execution", "id": "2527100", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527100"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-863", "details": ["A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. When attaching an instance group to a schedule or a workflow job\ntemplate node through the dedicated API relationship endpoint, the controller\nverifies only that the requesting user can read (view) the instance group,\nrather than that they hold use permission on it, unlike every other instance\ngroup assignment in the product. An authenticated user with read-only\nvisibility of an instance group -- for example a system auditor -- can attach a\nuse-restricted instance group, including the control plane group or another\ntenant's container group, to a schedule or workflow node they control. Their\nplaybook then executes on the control plane node or within another tenant's\nexecution environment, leading to privilege escalation and, in the control\nplane case, full compromise of the platform."], "name": "CVE-2026-84638", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-26/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-27/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}], "public_date": "2026-09-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-84638\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84638"], "statement": "This flaw affects automation-controller as shipped in Red Hat Ansible\nAutomation Platform. Exploitation requires an authenticated user who can modify\na schedule or workflow job template node and who can view (read) the target\ninstance group; the impact is escalation to code execution on the control plane\nnode or within another tenant's execution environment. [Verify AAP 2.4 -- see\naffects.]", "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "ansible_automation_platform", "vendor": "redhat"}], "created": "2026-09-24T01:30:12.995450+00:00", "updated": "2026-09-24T19:15:15.430456+00:00", "vendors": ["redhat", "redhat$PRODUCT$ansible_automation_platform"]}