VDB

CVE-2026-84718

CVE-2026-84718 PUBLISHED CVSS 4.3 MEDIUM

Reported by redhat · Published September 23, 2026

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost (attacker-controlled) header value. As a result, an attacker can forge the source IP address recorded for their requests in the Controller's audit and access logs, degrading the integrity of forensic and SIEM attribution. The flaw does not grant additional access.

Risk Scores

CVSS 3.1
4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected Products

VendorProductVersions
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:4.6.33-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:4.6.33-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 90:4.7.17-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.61789673739
Red HatRed Hat Ansible Automation Platform 2.71789580684
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:4.6.33-1.el8ap
Red HatRed Hat Ansible Automation Platform 2
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:4.6.33-1.el9ap
Red HatRed Hat Ansible Automation Platform 2
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 90:4.7.17-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.61789673739
Red HatRed Hat Ansible Automation Platform 2.71789580684

Timeline

  • Sep 23, 2026 Coalition ESS Score
  • Sep 23, 2026 CVE Published
  • Sep 24, 2026 EPSS Score
  • Sep 24, 2026 Distribution Patch
  • Sep 24, 2026 Security Advisory
  • Oct 6, 2026 EPSS Score
  • Oct 14, 2026 EPSS Score
  • Oct 16, 2026 CVE Updated
  • Oct 17, 2026 Distribution Patch
  • Oct 17, 2026 Distribution Patch
  • Oct 17, 2026 Distribution Patch
  • Oct 17, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›