CVE-2026-84644

{}

{}

{}

{"affected_release": [{"advisory": "RHSA-2026:71113", "cpe": "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "package": "automation-controller-0:4.7.17-1.el9ap", "product_name": "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "release_date": "2026-09-23T00:00:00Z"}], "bugzilla": {"description": "automation-controller-container: automation-controller: automation-controller: server-side request forgery via the Thycotic Secret Server external credential plugin test endpoint (caller-controlled server_url, backend executed in the controller web process)", "id": "2527117", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527117"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "status": "verified"}, "cwe": "CWE-918", "details": ["A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. The Thycotic Secret Server external credential plugin passes a\nuser-supplied server URL to its SDK without validating the scheme, host, or IP\nrange, and the plugin backend is executed synchronously within the automation\ncontroller web process. Using the external credential test endpoint, a user who\nholds only the use role on such a credential can override the stored server URL\nwith an arbitrary internal address, causing the control plane to issue requests\nto internal services. Although the response is a generic error, response timing\nreveals whether internal hosts and ports are reachable, enabling internal\nnetwork reconnaissance and a blind request-forgery primitive from the control\nplane, and each request can hold a web worker, affecting availability."], "name": "CVE-2026-84644", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-26/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-27/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}], "public_date": "2026-09-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-84644\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84644"], "statement": "This flaw affects automation-controller as shipped in Red Hat Ansible\nAutomation Platform. Exploitation requires an authenticated user with the use\nrole on a Thycotic Secret Server credential (or the ability to create one); the\nimpact is a blind server-side request forgery originating from the control-plane\nweb pod, enabling internal reconnaissance and a limited request-forgery/denial-\nof-service primitive", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.6"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "ansible_automation_platform", "vendor": "redhat"}], "created": "2026-09-24T02:30:13.562702+00:00", "updated": "2026-09-24T02:30:13.845755+00:00", "vendors": ["redhat", "redhat$PRODUCT$ansible_automation_platform"]}