CVE-2026-84712
Reported by redhat · Published September 23, 2026
A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory (node hostnames, node types, UUIDs, heartbeats, capacities, and exact versions), all instance-group names and membership, the deployment install UUID, and the active control node. A remote, unauthenticated attacker can use this to map the control plane and fingerprint software versions for targeted attacks. This flaw affects confidentiality only; it does not expose secrets, credentials, or tenant data.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:4.6.33-1.el8ap |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:4.6.33-1.el9ap |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:4.7.17-1.el9ap |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | 1789673739 |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | 1789580684 |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:4.7.17-1.el9ap |
| Red Hat | Red Hat Ansible Automation Platform 2 | |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | 1789673739 |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | 1789580684 |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:4.6.33-1.el9ap |
| Red Hat | Red Hat Ansible Automation Platform 2 | |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:4.6.33-1.el8ap |
Timeline
- Sep 23, 2026 Coalition ESS Score
- Sep 23, 2026 CVE Published
- Sep 24, 2026 EPSS Score (17 in total, the first dated here)
- Sep 24, 2026 Distribution Patch (4 in total, the first dated here)
- Sep 24, 2026 Security Advisory (4 in total, the first dated here)
- Oct 16, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-84712
vulnetix vdb fixes CVE-2026-84712Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-84712/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- RHSA-2026:71113 vendor-advisoryx_refsource_REDHAT
- RHSA-2026:71114 vendor-advisoryx_refsource_REDHAT
- RHSA-2026:71177 vendor-advisoryx_refsource_REDHAT
- RHSA-2026:71179 vendor-advisoryx_refsource_REDHAT
- vdb-entryx_refsource_REDHAT
- RHBZ#2527196 issue-trackingx_refsource_REDHAT