CVE-2026-84712
Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 23, 2026
- Updated
- Oct 16, 2026
- Reserved
- Sep 2, 2026
Description
A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory (node hostnames, node types, UUIDs, heartbeats, capacities, and exact versions), all instance-group names and membership, the deployment install UUID, and the active control node. A remote, unauthenticated attacker can use this to map the control plane and fingerprint software versions for targeted attacks. This flaw affects confidentiality only; it does not expose secrets, credentials, or tenant data.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | redhat |
Weaknesses
- CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected Products
| Product | Versions |
|---|---|
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat |
|
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat |
|
Red Hat Ansible Automation Platform 2.6 for RHEL 9Red Hat |
|
Red Hat Ansible Automation Platform 2.6Red Hat |
|
Red Hat Ansible Automation Platform 2.7Red Hat |
|
References
- RHSA-2026:71113vendor-advisory
- RHSA-2026:71114vendor-advisory
- RHSA-2026:71177vendor-advisory
- RHSA-2026:71179vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-84712vdb-entry
- RHBZ#2527196issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.