Skip to content
Fencer Intel
critical 9.9

CVE-2026-84719 json

Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)

published last mo. modified 7d ago also EUVD-2026-85606

cvss
9.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 39%
public exploits
0
none known

Summary

A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of each cloned node and fails to check the instance_groups (and execution_environment and labels) that were preserved from the original. A user with organization workflow-admin permission but no role on the referenced instance groups can copy a workflow, become its administrator, and launch jobs pinned to instance groups they are not authorized to use — including the control-plane instance group — bypassing the InstanceGroup use_role boundary and causing attacker-influenced automation to run in the control-plane execution context.

Patch / fix

  • Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 0:4.5.36-1.el8ap
  • Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9 0:4.5.36-1.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:4.6.33-1.el8ap
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:4.6.33-1.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:4.7.17-1.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.6 1789673739
  • Red Hat Red Hat Ansible Automation Platform 2.7 1789580684
  • automation-controller-venv-tower ansible automation platform 2.4 4.5.36-1.el8ap
  • automation-controller-venv-tower ansible automation platform 2.4 4.5.36-1.el9ap
  • receptor ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.8-1.el8ap
  • receptor ansible automation platform inside 2.6, ansible automation platform inside 2.5, ansible automation platform developer 2.6 +3 more 1.6.8-1.el9ap
  • python3.12-sqlparse ansible automation platform developer 2.5, ansible automation platform 2.5 0.6.0-1.el8ap
  • python3.12-sqlparse ansible automation platform developer 2.6, ansible automation platform developer 2.5, ansible automation platform 2.6 +1 more 0.6.0-1.el9ap
  • python3.12-gitpython ansible automation platform 2.5 3.1.60-1.el8ap
  • python3.12-gitpython ansible automation platform 2.6, ansible automation platform 2.5 3.1.60-1.el9ap

red hat advisories RHSA-2026:71115RHSA-2026:71114RHSA-2026:71113

Is CVE-2026-84719 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-84719 updated cvss 9.9

automation-controller: automation-controller: WorkflowJobTemplate /copy/ deep-copy sanitizer omits instance_groups authorization (InstanceGroup use_role bypass to control-plane)

  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-venv-tower 4.5.36-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-venv-tower 4.5.36-1.el9ap
    fixed: vendor fix RHSA-2026:71115
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower 4.6.33-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower 4.6.33-1.el9ap
    fixed: vendor fix RHSA-2026:71114
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/controller-rhel9 1789673739
    fixed: vendor fix RHSA-2026:71179
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-venv-tower 4.7.17-1.el9ap
    fixed: vendor fix RHSA-2026:71113
  • Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/controller-rhel9 1789580684
    fixed: vendor fix RHSA-2026:71177
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller 4.5.36-1.el8ap, automation-controller-ui 4.5.36-1.el8ap, automation-controller-cli 4.5.36-1.el8ap, automation-controller-server 4.5.36-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller 4.5.36-1.el9ap, automation-controller-ui 4.5.36-1.el9ap, automation-controller-cli 4.5.36-1.el9ap, automation-controller-server 4.5.36-1.el9ap Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.6.8-1.el8ap, receptorctl 1.6.8-1.el8ap, automation-hub 4.10.19-1.el8ap, python3.12-sqlparse 0.6.0-1.el8ap, python3.12-gitpython 3.1.60-1.el8ap, automation-controller 4.6.33-1.el8ap, +14 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.6.8-1.el9ap, receptorctl 1.6.8-1.el9ap, automation-hub 4.10.19-1.el9ap, python3.12-sqlparse 0.6.0-1.el9ap, python3.12-gitpython 3.1.60-1.el9ap, automation-controller 4.6.33-1.el9ap, +14 more Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1789611274, ansible-automation-platform-26/gateway-rhel9 1789666472, ansible-automation-platform-26/hub-web-rhel9 1789615881, ansible-automation-platform-26/receptor-rhel9 1789610120, ansible-automation-platform-26/mcp-tools-rhel9 1789609282, ansible-automation-platform-26/de-minimal-rhel9 1789658734, +24 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.8-1.el9ap, receptorctl 1.6.8-1.el9ap, automation-hub 4.11.14-1.el9ap, python3.12-sqlparse 0.6.0-1.el9ap, python3.12-gitpython 3.1.60-1.el9ap, automation-controller 4.7.17-1.el9ap, +28 more
    +2 more products
    Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.8-1.el10ap, receptorctl 1.6.8-1.el10ap, python-sqlparse 0.6.0-1.el10ap, python3-sqlparse 0.6.0-1.el10ap Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-rhel9 1789572632, ansible-automation-platform-27/gateway-rhel9 1789579764, ansible-automation-platform-27/hub-web-rhel9 1789575016, ansible-automation-platform-27/receptor-rhel9 1789519651, ansible-automation-platform-27/mcp-tools-rhel9 1789521154, ansible-automation-platform-27/de-minimal-rhel9 1789582543, +25 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
last mo.

Exploit prediction

0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6
  • Red Hat Red Hat Ansible Automation Platform 2.7

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.