CVE-2026-84719: Automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)
Red Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 8
Vendor fix available · Affected: Red Hat Ansible Automation Platform 2.4 for RHEL 8 · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
Higher than 39% of scored CVEs
DescriptionNVD
A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of each cloned node and fails to check the instance_groups (and execution_environment and labels) that were preserved from the original. A user with organization workflow-admin permission but no role on the referenced instance groups can copy a workflow, become its administrator, and launch jobs pinned to instance groups they are not authorized to use — including the control-plane instance group — bypassing the InstanceGroup use_role boundary and causing attacker-influenced automation to run in the control-plane execution context.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- Red Hat
- Published
- September 2026
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 24 Sep.
- Red Hat Fixes Critical Ansible Flaws Enabling Control Plane TakeoverSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.