Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2026-84719

Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of each cloned node and fails to check the instance_groups (and execution_environment and labels) that were preserved from the original. A user with organization workflow-admin permission but no role on the referenced instance groups can copy a workflow, become its administrator, and launch jobs pinned to instance groups they are not authorized to use — including the control-plane instance group — bypassing the InstanceGroup use_role boundary and causing attacker-influenced automation to run in the control-plane execution context.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8

Default version status: affected

  • 0:4.5.36-1.el8ap to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9

Default version status: affected

  • 0:4.5.36-1.el9ap to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Default version status: affected

  • 0:4.6.33-1.el8ap to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9

Default version status: affected

  • 0:4.6.33-1.el9ap to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9

Default version status: affected

  • 0:4.7.17-1.el9ap to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.6

Default version status: affected

  • 1789673739 to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.7

Default version status: affected

  • 1789580684 to < *unaffected

References