CVE-2026-84689

{}

{}

{}

{"affected_release": [{"advisory": "RHSA-2026:71113", "cpe": "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "package": "automation-controller-0:4.7.17-1.el9ap", "product_name": "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "release_date": "2026-09-23T00:00:00Z"}], "bugzilla": {"description": "automation-controller: automation-controller-container: automation-controller: bulk job launch allows setting a workflow node's job reference to an arbitrary unified job, enabling a low-privileged user to cancel and read metadata of jobs in other organizations", "id": "2527145", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527145"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H", "status": "verified"}, "cwe": "CWE-915", "details": ["A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. The bulk job launch endpoint builds workflow job nodes from client\ninput using a serializer that leaves the node's job reference -- a field normally\nset by the workflow task manager after it spawns a child job -- writable and does\nnot include it in the permission validation performed for the other node fields.\nAn authenticated user with permission to execute a single job template can submit\na bulk job launch whose node references the identifier of any unified job in any\norganization, including jobs they cannot access. The node then exposes that job's\nmetadata, and cancelling the attacker's workflow cancels the referenced job\nthrough the workflow cancellation cascade, without any per-job authorization\ncheck. Repeated, this allows a low-privileged user to cancel running jobs,\nproject and inventory syncs, ad hoc commands, and system jobs across all\norganizations, denying automation service platform-wide."], "name": "CVE-2026-84689", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-26/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-27/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}], "public_date": "2026-09-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-84689\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84689"], "statement": "This flaw affects automation-controller as shipped in Red Hat Ansible\nAutomation Platform. Exploitation requires an authenticated user with execute\npermission on a job template; the impact is cross-tenant cancellation of running\nautomation (denial of service) and disclosure of job metadata.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.6"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "ansible_automation_platform", "vendor": "redhat"}], "created": "2026-09-24T01:45:13.237615+00:00", "updated": "2026-09-28T00:45:13.918089+00:00", "vendors": ["redhat", "redhat$PRODUCT$ansible_automation_platform"]}