CVE-2026-84486: Automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (allowany, routed without debug guard) allow advisory-lock starvation of job dispatch (dos)
Red Hat · Red Hat Ansible Automation Platform 2.6 for RHEL 9
Vendor fix available · Affected: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 51% of scored CVEs
DescriptionCVE.org
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views that trigger the internal task, dependency, and workflow schedulers are configured to allow any user (including unauthenticated clients) and are routed in production builds because their URL include is not gated on the debug setting. An unauthenticated remote attacker can repeatedly invoke these endpoints to acquire the cluster-wide scheduler advisory lock; because the legitimate scheduler acquires the same lock without waiting, the attacker causes real scheduler runs to be skipped, stalling job dispatch for all tenants, while also consuming controller web workers. The debug root view additionally discloses the list of debug endpoints to unauthenticated callers.
Affected products4
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Red Hat · Red Hat Ansible Automation Platform 2.6 for RHEL 9Versions not stated
- Red Hat · Red Hat Ansible Automation Platform 2.6 for RHEL 9Versions not stated
- Red Hat · Red Hat Ansible Automation Platform 2.6Versions not stated
- Red Hat · Red Hat Ansible Automation Platform 2.7Versions not stated
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- Red Hat
- Published
- September 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-84486 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.