Red Hat Patches Eight Serious Flaws in Ansible Automation Platform Controller
Red Hat published errata RHSA-2026:71115 on 23 September 2026, an update for Red Hat Ansible Automation Platform 2.4 that Red Hat Product Security has rated Critical. The update closes eight separate vulnerabilities in the automation-controller component, the part of the platform that stores credentials, schedules jobs and decides which execution environments an automation job may run on. The flaws are CVE-2026-84474, CVE-2026-84719, CVE-2026-84711, CVE-2026-84684, CVE-2026-84638, CVE-2026-84502, CVE-2026-75884 and CVE-2026-12564, and they cover remote code execution, arbitrary file read, several distinct privilege escalations and one credential exfiltration path. Affected products are Ansible Automation Platform 2.4 for RHEL 8 and RHEL 9 on x86_64, s390x, ppc64le and aarch64, along with Red Hat Ansible Developer 1.1 on the same platforms. Fixed packages are shipped as automation-controller 4.5.36-1.el8ap and 4.5.36-1.el9ap, together with the matching cli, server, ui and venv-tower subpackages.
The advisory and its linked Bugzilla entries describe the mechanisms in unusually plain terms. Two issues are git argument injection: a crafted Project scm_url is passed into a git ls-remote –upload-pack invocation and yields code execution on the controller-task control-plane pod (CVE-2026-84502), while a crafted scm_branch or scm_refspec is injected into git during project sync and allows arbitrary file read on the sync host, explicitly including the control-plane ServiceAccount token, the Django SECRET_KEY and database credentials (CVE-2026-84711). Three of the flaws are authorisation checks that test the wrong permission. Instance groups can be attached to schedules and workflow job template nodes with only read permission, letting a user bind jobs to restricted control-plane or other-tenant groups (CVE-2026-84638); the WorkflowJobTemplate copy endpoint has a deep-copy sanitiser that omits instance_groups authorisation entirely, bypassing the InstanceGroup use_role (CVE-2026-84719); and constructed inventory attachment validates only read permission on the source inventory, letting a read-only user clone another tenant's hosts (CVE-2026-84684). The remaining three involve exposure of the host_config_key combined with X-Forwarded-For spoofing to defeat provisioning-callback host matching and turn view_jobtemplate into execute (CVE-2026-84474), pod_spec_override injection in container groups to escalate into an OpenShift namespace (CVE-2026-75884), and server-side request forgery through a HashiCorp Vault credential that exfiltrates a Kubernetes service account token (CVE-2026-12564).
Ansible Automation Platform sits at the top of the privilege pyramid in the environments that run it. The controller holds machine credentials, cloud keys and vault secrets for large estates, and a compromise of the control plane is effectively a compromise of everything that platform automates. Several of these issues turn an ordinary low-privilege platform user, the kind of account handed out liberally to application teams, into an actor who can read control-plane secrets, run jobs on restricted instance groups or reach into another tenant's inventory. That matters most for multi-tenant deployments and managed service providers, where the separation between customer organisations is enforced by exactly the role checks these bugs bypass. On current exploitation status, FIRST EPSS places the probability of exploitation in the next 30 days at 0.8 percent for CVE-2026-84474, 0.6 percent for CVE-2026-84502, 0.4 percent for CVE-2026-84719, 0.4 percent for CVE-2026-75884 and 0.3 percent for CVE-2026-12564; no exploitation data has been published for CVE-2026-84711, CVE-2026-84684 or CVE-2026-84638, and neither Red Hat nor the referenced Bugzilla records describe any observed attacks. The fix has been available since the errata date, so the practical exposure window is now determined by patch cadence rather than by attacker availability.
Attack Surface
System Management Service, Web Application, Cloud Service, Infrastructure
Tactics
Privilege Escalation, Execution, Credential Access, Collection
Techniques
- T1068 – Exploitation for Privilege Escalation
- T1190 – Exploit Public-Facing Application
- T1059 – Command and Scripting Interpreter
- T1552.001 – Unsecured Credentials: Credentials In Files
- T1552.007 – Unsecured Credentials: Container API
- T1005 – Data from Local System
SuperPRO's Threat Countermeasures Procedures
- Apply RHSA-2026:71115 and bring every controller node to automation-controller 4.5.36-1.el8ap or 4.5.36-1.el9ap, updating the automation-controller-server, automation-controller-ui, automation-controller-cli and automation-controller-venv-tower subpackages together; the same fix applies to Red Hat Ansible Developer 1.1 hosts on RHEL 8 and RHEL 9.
- Use the Red Hat Insights patch analysis linked from the errata, or run rpm -q automation-controller across the estate, to enumerate hosts still below 4.5.36-1 including the s390x, ppc64le and aarch64 builds that are easy to miss in x86-centric inventories.
- Until the update is staged, review every Project object for unexpected values in scm_url, scm_branch and scm_refspec, in particular strings beginning with a hyphen or containing –upload-pack, since these are the exact injection points behind CVE-2026-84502 and CVE-2026-84711.
- Verify REMOTE_HOST_HEADERS on the controller so X-Forwarded-For is only trusted when the controller sits behind a known proxy, and disable provisioning callbacks or rotate the host_config_key on job templates where callback-based host matching is not required, which removes the path used by CVE-2026-84474.
- Restrict the ability to create or edit container groups and to supply pod_spec_override to platform administrators only, and review existing container group definitions for injected namespace, serviceAccountName or volume entries linked to CVE-2026-75884.
- Audit InstanceGroup use_role grants, schedules, workflow job template nodes and any workflow created through the /copy/ endpoint for bindings to the controlplane instance group or to another organisation's groups, and remove bindings that the owning user could not legitimately have been granted (CVE-2026-84638 and CVE-2026-84719).
- If the project sync host or controller-task pod is suspected of exposure, rotate the Django SECRET_KEY, the controller database credentials and the control-plane Kubernetes ServiceAccount token, and review HashiCorp Vault credential definitions for URLs pointing at internal or link-local addresses such as 169.254.169.254 that indicate the SSRF path in CVE-2026-12564.
