CVE-2026-84680

{}

{}

{}

{"affected_release": [{"advisory": "RHSA-2026:71113", "cpe": "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "package": "automation-controller-0:4.7.17-1.el9ap", "product_name": "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "release_date": "2026-09-23T00:00:00Z"}], "bugzilla": {"description": "automation-controller: automation-controller-container: automation-controller: organization galaxy credential attachment checks only read permission on the credential, allowing an organization admin with read-only visibility to bind and server-side-use another tenant's Automation Hub API token", "id": "2527126", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527126"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "status": "verified"}, "cwe": "CWE-863", "details": ["A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. When attaching a Galaxy or Automation Hub credential to an\norganization through the galaxy_credentials relationship endpoint, the\ncontroller verifies only that the requesting user can read the credential,\nrather than that they hold use permission on it, unlike other credential\nconsumption in the product. An authenticated user who administers one\norganization and has read-only visibility of a credential in another\norganization -- for example a platform auditor -- can bind that foreign\ncredential to their own organization. On the next project synchronization the\ncontroller decrypts the credential server-side and uses its token to\nauthenticate to the credential owner's Automation Hub, allowing cross-tenant use\nof another organization's secret."], "name": "CVE-2026-84680", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-26/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-27/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}], "public_date": "2026-09-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-84680\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84680"], "statement": "This flaw affects automation-controller as shipped in Red Hat Ansible\nAutomation Platform. Exploitation requires an authenticated user who administers\nan organization and can read (view) a Galaxy/Hub credential in another\norganization; the impact is cross-tenant server-side use of that credential's\nAutomation Hub token.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "ansible_automation_platform", "vendor": "redhat"}], "created": "2026-09-24T01:45:13.237916+00:00", "updated": "2026-09-24T16:00:14.340347+00:00", "vendors": ["redhat", "redhat$PRODUCT$ansible_automation_platform"]}