CVE-2026-84703

{}

{}

{}

{"affected_release": [{"advisory": "RHSA-2026:71113", "cpe": "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "package": "automation-controller-0:4.7.17-1.el9ap", "product_name": "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "release_date": "2026-09-23T00:00:00Z"}], "bugzilla": {"description": "automation-controller: automation-controller-container: automation-controller: execution environment credential foreign key is not use-permission checked, allowing an organization execution-environment admin to bind and disclose another organization's container registry credential (cross-tenant credential disclosure)", "id": "2527156", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527156"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "status": "verified"}, "cwe": "CWE-639", "details": ["A flaw was found in Red Hat Ansible Automation Platform's automation-controller.\nWhen creating or editing an execution environment, the controller does not verify\nthat the requesting user has use permission on the container registry credential\nreferenced by the execution environment; it validates only the organization and\nthe credential kind. An authenticated user who is an execution-environment admin\nof one organization can associate a container registry credential belonging to a\ndifferent organization -- one they cannot otherwise read, list, or use -- to an\nexecution environment they control. When a job runs with that execution\nenvironment, the controller decrypts the foreign credential's registry password\nand supplies it to the container runtime, disclosing another organization's\nregistry credentials across the tenant boundary."], "name": "CVE-2026-84703", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-26/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-27/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}], "public_date": "2026-09-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-84703\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84703"], "statement": "This flaw affects automation-controller as shipped in Red Hat Ansible Automation\nPlatform. Exploitation requires an authenticated user with the organization\nexecution-environment admin role; the impact is disclosure of another\norganization's container registry credentials across the tenant boundary.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": ["el9"], "status": "affected", "versions": {"scheme": "generic", "value": "2.6"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "ansible_automation_platform", "vendor": "redhat"}], "created": "2026-09-24T01:45:13.237245+00:00", "updated": "2026-09-24T05:30:05.540181+00:00", "vendors": ["redhat", "redhat$PRODUCT$ansible_automation_platform"]}