CVE-2026-844749.9CriticalCWE-807

CVE-2026-84474: Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioning-callback host match

Red Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 8

Vendor fix available · Affected: Red Hat Ansible Automation Platform 2.4 for RHEL 8 · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.8%probability of exploitation in the next 30 days

57th percentile

050100

Higher than 57% of scored CVEs

9.9CriticalCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret (host_config_key) is exposed to users holding only the read-level view_jobtemplate permission -- both in the job template API representation and in the activity stream -- and the provisioning callback endpoint trusts a client-supplied X-Forwarded-For header to determine the calling host when the controller is deployed behind the AAP gateway with an empty proxy allow-list. By reading the secret and spoofing X-Forwarded-For to match any host in the job template's inventory, a minimally privileged or unauthenticated remote attacker can launch the job template against arbitrary managed hosts using the job template's credentials, resulting in privilege escalation and remote code execution on managed hosts.

Affected products12

From the CVE record. A product or version that is not listed is unknown, not unaffected.

Red Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 8Versions not stated
Red Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 8Versions not stated
Red Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 9Versions not stated
Red Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 9Versions not stated
Red Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 8Versions not stated
Red Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 8Versions not stated
Red Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 9Versions not stated
Red Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 9Versions not stated
Red Hat · Red Hat Ansible Automation Platform 2.6 for RHEL 9Versions not stated
Red Hat · Red Hat Ansible Automation Platform 2.6 for RHEL 9Versions not stated
Red Hat · Red Hat Ansible Automation Platform 2.6Versions not stated
Red Hat · Red Hat Ansible Automation Platform 2.7Versions not stated

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Reliance on Untrusted Inputs in a Security Decision · Input Validation and Logic
Vendor: Red Hat
Published: September 2026
Band: Unlikely (under 1%), September 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-84474 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.