VDB

CVE-2026-84719

CVE-2026-84719 PUBLISHED CVSS 9.9 CRITICAL

Reported by redhat · Published September 23, 2026

A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of each cloned node and fails to check the instance_groups (and execution_environment and labels) that were preserved from the original. A user with organization workflow-admin permission but no role on the referenced instance groups can copy a workflow, become its administrator, and launch jobs pinned to instance groups they are not authorized to use — including the control-plane instance group — bypassing the InstanceGroup use_role boundary and causing attacker-influenced automation to run in the control-plane execution context.

Risk scores

CVSS 3.1
9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

VendorProductVersions
Red HatRed Hat Ansible Automation Platform 2.4 for RHEL 80:4.5.36-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.4 for RHEL 90:4.5.36-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:4.6.33-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:4.6.33-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 90:4.7.17-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.61789673739
Red HatRed Hat Ansible Automation Platform 2.71789580684
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 90:4.7.17-1.el9ap
Red HatRed Hat Ansible Automation Platform 2
Red HatRed Hat Ansible Automation Platform 2.71789580684
Red HatRed Hat Ansible Automation Platform 2
Red HatRed Hat Ansible Automation Platform 2.4 for RHEL 80:4.5.36-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.61789673739
Red HatRed Hat Ansible Automation Platform 2.4 for RHEL 90:4.5.36-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:4.6.33-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:4.6.33-1.el9ap

Timeline

  • Sep 23, 2026 Coalition ESS Score
  • Sep 23, 2026 CVE Published
  • Sep 24, 2026 EPSS Score (14 in total, the first dated here)
  • Sep 24, 2026 Distribution Patch (5 in total, the first dated here)
  • Sep 24, 2026 Security Advisory (5 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-84719
vulnetix vdb fixes CVE-2026-84719

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-84719/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›