Skip to content
Fencer Intel
medium 4.3

CVE-2026-84718 json

Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust

published last mo. modified 6d ago also EUVD-2026-85613

cvss
4.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 3%
public exploits
0
none known

Summary

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost (attacker-controlled) header value. As a result, an attacker can forge the source IP address recorded for their requests in the Controller's audit and access logs, degrading the integrity of forensic and SIEM attribution. The flaw does not grant additional access.

Patch / fix

  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:4.6.33-1.el8ap
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:4.6.33-1.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:4.7.17-1.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.6 1789673739
  • Red Hat Red Hat Ansible Automation Platform 2.7 1789580684
  • receptor ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.8-1.el8ap
  • receptor ansible automation platform inside 2.6, ansible automation platform inside 2.5, ansible automation platform developer 2.6 +3 more 1.6.8-1.el9ap
  • python3.12-sqlparse ansible automation platform developer 2.5, ansible automation platform 2.5 0.6.0-1.el8ap
  • python3.12-sqlparse ansible automation platform developer 2.6, ansible automation platform developer 2.5, ansible automation platform 2.6 +1 more 0.6.0-1.el9ap
  • python3.12-gitpython ansible automation platform 2.5 3.1.60-1.el8ap
  • python3.12-gitpython ansible automation platform 2.6, ansible automation platform 2.5 3.1.60-1.el9ap
  • automation-gateway-server ansible automation platform 2.5 2.5.20260923-1.el8ap
  • automation-gateway-server ansible automation platform 2.5 2.5.20260923-1.el9ap

red hat advisories RHSA-2026:71114RHSA-2026:71113

Is CVE-2026-84718 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-84718 updated cvss 4.3

automation-controller: automation-controller: client IP spoofing in audit/access logs via unrestricted X-Forwarded-For trust

  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower 4.6.33-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower 4.6.33-1.el9ap
    fixed: vendor fix RHSA-2026:71114
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/controller-rhel9 1789673739
    fixed: vendor fix RHSA-2026:71179
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-venv-tower 4.7.17-1.el9ap
    fixed: vendor fix RHSA-2026:71113
  • Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/controller-rhel9 1789580684
    fixed: vendor fix RHSA-2026:71177
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.6.8-1.el8ap, receptorctl 1.6.8-1.el8ap, automation-hub 4.10.19-1.el8ap, python3.12-sqlparse 0.6.0-1.el8ap, python3.12-gitpython 3.1.60-1.el8ap, automation-controller 4.6.33-1.el8ap, +14 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.6.8-1.el9ap, receptorctl 1.6.8-1.el9ap, automation-hub 4.10.19-1.el9ap, python3.12-sqlparse 0.6.0-1.el9ap, python3.12-gitpython 3.1.60-1.el9ap, automation-controller 4.6.33-1.el9ap, +14 more Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1789611274, ansible-automation-platform-26/gateway-rhel9 1789666472, ansible-automation-platform-26/hub-web-rhel9 1789615881, ansible-automation-platform-26/receptor-rhel9 1789610120, ansible-automation-platform-26/mcp-tools-rhel9 1789609282, ansible-automation-platform-26/de-minimal-rhel9 1789658734, +24 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.8-1.el9ap, receptorctl 1.6.8-1.el9ap, automation-hub 4.11.14-1.el9ap, python3.12-sqlparse 0.6.0-1.el9ap, python3.12-gitpython 3.1.60-1.el9ap, automation-controller 4.7.17-1.el9ap, +28 more Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.8-1.el10ap, receptorctl 1.6.8-1.el10ap, python-sqlparse 0.6.0-1.el10ap, python3-sqlparse 0.6.0-1.el10ap Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-rhel9 1789572632, ansible-automation-platform-27/gateway-rhel9 1789579764, ansible-automation-platform-27/hub-web-rhel9 1789575016, ansible-automation-platform-27/receptor-rhel9 1789519651, ansible-automation-platform-27/mcp-tools-rhel9 1789521154, ansible-automation-platform-27/de-minimal-rhel9 1789582543, +25 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
last mo.

Exploit prediction

0.14% chance of exploitation in the next 30 days, higher than 3% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected products

  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6
  • Red Hat Red Hat Ansible Automation Platform 2.7

Classification

Weakness
  • CWE-348 Use of Less Trusted Source

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.