CVE-2026-84684

{}

{}

{}

{"affected_release": [{"advisory": "RHSA-2026:71115", "cpe": "cpe:/a:redhat:ansible_automation_platform:2.4::el8", "package": "automation-controller-0:4.5.36-1.el8ap", "product_name": "Red Hat Ansible Automation Platform 2.4 for RHEL 8", "release_date": "2026-09-23T00:00:00Z"}, {"advisory": "RHSA-2026:71115", "cpe": "cpe:/a:redhat:ansible_automation_platform:2.4::el9", "package": "automation-controller-0:4.5.36-1.el9ap", "product_name": "Red Hat Ansible Automation Platform 2.4 for RHEL 9", "release_date": "2026-09-23T00:00:00Z"}, {"advisory": "RHSA-2026:71113", "cpe": "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "package": "automation-controller-0:4.7.17-1.el9ap", "product_name": "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "release_date": "2026-09-23T00:00:00Z"}], "bugzilla": {"description": "automation-controller: automation-controller-container: automation-controller: constructed inventory input inventory attachment checks only read permission on the source inventory, allowing a read-only user to clone another tenant's hosts and secrets and run ad hoc commands against them", "id": "2527139", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527139"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "status": "verified"}, "cwe": "CWE-863", "details": ["A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. When attaching a source inventory to a constructed inventory through\nthe input_inventories relationship endpoint, the controller verifies only that\nthe requesting user can read the source inventory, rather than that they hold use\npermission on it, unlike instance group attachment on the same access class. An\nauthenticated user who can administer a constructed inventory and has read-only\nvisibility of an inventory in another organization -- for example an\norganization or system auditor -- can attach that foreign inventory as an input.\nOn synchronization the controller clones every host and host variable, including\nsecrets, into the attacker's inventory, and because the attacker administers the\nconstructed inventory they can run ad hoc commands against the cloned hosts,\nresulting in cross-tenant disclosure of inventory data and secrets and code\nexecution against another tenant's managed hosts."], "name": "CVE-2026-84684", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-26/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-27/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}], "public_date": "2026-09-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-84684\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84684"], "statement": "This flaw affects automation-controller as shipped in Red Hat Ansible\nAutomation Platform. Exploitation requires an authenticated user who can\nadminister a constructed inventory and can read (view) an inventory in another\norganization; the impact is cross-tenant disclosure of inventory data and\nsecrets and ad hoc code execution against another tenant's hosts.", "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "ansible_automation_platform", "vendor": "redhat"}], "created": "2026-09-24T01:45:13.237769+00:00", "updated": "2026-09-24T15:00:16.393695+00:00", "vendors": ["redhat", "redhat$PRODUCT$ansible_automation_platform"]}