CVE-2026-84474 Red Hat Ansible Automation Platform - Privilege Escalation & Remote Code Execution

Red Hat Ansible Automation Platform automation-controller contains a privilege escalation and remote code execution vulnerability caused by exposure of provisioning-callback secret and trusting client-supplied X-Forwarded-For header, letting minimally privileged or unauthenticated attackers execute jobs on arbitrary managed hosts, exploit requires empty proxy allow-list and read-level view_jobtemplate permission.

CVSS base score 9.9 /10
Critical
CISA KEV
Not listed
Public exploit
None known
Authentication
Required
EPSS
0.80% chance of exploitation in 30 days
View the NVD record ↗

Details

Type
Privilege Escalation
Impact
Remote Code Execution, Privilege Escalation
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published
23 September 2026
Updated
15 October 2026
Weakness
CWE-807

Vendor fix

Update to the latest version of Red Hat Ansible Automation Platform.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

References

← All CVEs