CVE-2026-84643

{}

{}

{}

{"affected_release": [{"advisory": "RHSA-2026:71113", "cpe": "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "package": "automation-controller-0:4.7.17-1.el9ap", "product_name": "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "release_date": "2026-09-23T00:00:00Z"}], "bugzilla": {"description": "automation-controller: automation-controller-container: automation-controller: missing use_role authorization on the project signature validation credential foreign key allows a project administrator to bind and use another organization's credential cross-tenant", "id": "2527112", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527112"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.0", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "status": "verified"}, "cwe": "CWE-639", "details": ["A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. A project has a signature validation credential foreign key used to\nvalidate signed project content. Unlike the project's SCM credential, the\nauthorization logic does not verify that the requesting user has use permission\non the referenced credential, and the API field has no validator or type\nrestriction. An authenticated user holding only the organization project\nadministrator role can therefore bind an arbitrary credential belonging to\nanother organization, by its identifier, when creating or updating a project.\nThe controller discloses that credential's name and type in the project's\nsummary information and, during project synchronization, decrypts the bound\ncredential and uses it in the attacker-controlled project's update, allowing a\ncross-tenant authorization boundary violation and information disclosure."], "name": "CVE-2026-84643", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-26/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-27/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}], "public_date": "2026-09-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-84643\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84643"], "statement": "This flaw affects automation-controller as shipped in Red Hat Ansible\nAutomation Platform. Exploitation requires an authenticated user holding the\nOrganization Project Admin role; the impact is a cross-tenant authorization\nboundary violation, disclosing another organization's credential metadata and\ncausing server-side use of that credential during project synchronization.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "ansible_automation_platform", "vendor": "redhat"}], "created": "2026-09-24T01:30:12.994765+00:00", "updated": "2026-09-28T06:45:05.870672+00:00", "vendors": ["redhat", "redhat$PRODUCT$ansible_automation_platform"]}