A flaw was found in Red Hat Ansible Automation Platform's automation-
controller. The provisioning-callback secret (host_config_key) is exposed to
users holding only the read-level view_jobtemplate permission -- both in the
job template API representation and in the activity stream -- and the
provisioning callback endpoint trusts a client-supplied X-Forwarded-For
header to determine the calling host when the controller is deployed behind
the AAP gateway with an empty proxy allow-list. By reading the secret and
spoofing X-Forwarded-For to match any host in the job template's inventory, a
minimally privileged or unauthenticated remote attacker can launch the job
template against arbitrary managed hosts using the job template's credentials,
resulting in privilege escalation and remote code execution on managed hosts.
References
Configurations
No configuration.
History
24 Sep 2026, 06:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
24 Sep 2026, 04:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
23 Sep 2026, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
23 Sep 2026, 19:19
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-09-23 19:19
Updated : 2026-09-24 06:17
NVD link : CVE-2026-84474
Mitre link : CVE-2026-84474
CVE.ORG link : CVE-2026-84474
JSON object : View
Products Affected
No product.
CWE
CWE-807
Reliance on Untrusted Inputs in a Security Decision