CVE-2026-84486: Red Hat Ansible Automation Platform DoS Flaw

CVE-2026-84486 Overview

CVE-2026-84486 affects Red Hat Ansible Automation Platform's automation-controller component. Four debug views that trigger internal task, dependency, and workflow schedulers are exposed to unauthenticated clients in production builds. The URL include for these routes is not gated on the debug setting, leaving the endpoints reachable by any remote caller. An attacker can repeatedly invoke them to acquire the cluster-wide scheduler advisory lock, blocking legitimate scheduler runs and stalling job dispatch across all tenants. The debug root view also enumerates the debug endpoints to unauthenticated callers, aiding reconnaissance. The weakness is classified as [CWE-489] Active Debug Code.

Critical Impact

Unauthenticated remote attackers can halt job dispatch across all tenants and exhaust controller web workers by repeatedly acquiring the scheduler advisory lock.

Affected Products

• Red Hat Ansible Automation Platform (automation-controller)
• Red Hat Ansible Automation Platform builds covered by RHSA-2026:71113
• Red Hat Ansible Automation Platform builds covered by RHSA-2026:71177 and RHSA-2026:71179

Discovery Timeline

• 2026-09-23 - CVE-2026-84486 published to NVD
• 2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-84486

Vulnerability Analysis

The automation-controller component ships debug views intended for development that expose scheduler trigger endpoints. In production builds, the URL include registering these views is unconditionally loaded rather than gated behind a debug flag. As a result, four routes that invoke the internal task scheduler, dependency scheduler, and workflow scheduler remain reachable without authentication.

Each invocation causes the handler to acquire the cluster-wide scheduler advisory lock. The legitimate scheduler acquires the same lock without waiting, so contention causes real scheduler cycles to be skipped rather than queued. Repeated invocations therefore prevent job dispatch across every tenant on the cluster while simultaneously tying up controller web workers, degrading the entire control plane.

A secondary information disclosure exists in the debug root view. It lists all registered debug endpoints to unauthenticated callers, giving an attacker a ready-made map of the vulnerable routes.

Root Cause

The root cause is active debug code shipped in production ([CWE-489]). The URL include for the debug views is registered globally and is not conditioned on a debug or environment flag. Access control on the views themselves is set to permit any user, including unauthenticated clients.

Attack Vector

The attack is remote and network-based. An unauthenticated attacker sends HTTP requests to the exposed scheduler debug endpoints on the controller. No user interaction, credentials, or prior foothold are required. Refer to the Red Hat CVE Analysis for CVE-2026-84486 and Red Hat Bug Report #2527085 for handler-level details.

Detection Methods for CVE-2026-84486

Indicators of Compromise

• Unauthenticated HTTP requests from external or unexpected internal sources hitting automation-controller debug URL paths that trigger the task, dependency, or workflow scheduler.
• Repeated requests to the debug root view enumerating available debug endpoints.
• Bursts of controller web worker saturation correlated with scheduler advisory lock contention in PostgreSQL.

Detection Strategies

• Inspect reverse proxy and controller access logs for requests to scheduler-related debug routes, especially without a valid session cookie or bearer token.
• Query PostgreSQL pg_locks for repeated acquisition of the scheduler advisory lock by non-scheduler backends.
• Alert on skipped scheduler cycles or growing job dispatch latency reported in controller logs.

Monitoring Recommendations

• Forward automation-controller web and task logs to a centralized analytics platform for URL-path baselining and anomaly detection.
• Monitor web worker utilization and request queue depth on controller nodes and alert on sustained saturation.
• Track job dispatch throughput per tenant and alert when scheduled jobs remain in a pending state beyond expected intervals.

How to Mitigate CVE-2026-84486

Immediate Actions Required

• Apply the fixed automation-controller packages from the applicable Red Hat Security Advisories to all controller nodes.
• Restrict network access to controller HTTP endpoints so only authenticated administrative networks can reach the API and UI.
• Review controller access logs for prior unauthenticated hits against scheduler debug URLs and record any observed source addresses.

Patch Information

Red Hat has published fixes in RHSA-2026:71113, RHSA-2026:71177, and RHSA-2026:71179. Administrators should consult the Red Hat CVE Analysis for CVE-2026-84486 to map the correct advisory to their deployed Ansible Automation Platform channel and apply the update.

Workarounds

• Block the scheduler debug URL paths at the load balancer or reverse proxy fronting automation-controller until patches are installed.
• Require authentication at the proxy layer for all controller HTTP routes as a defense-in-depth measure.
• Limit inbound network exposure of controller nodes to management VLANs or VPN-reachable ranges only.

# Example NGINX snippet to block unauthenticated access to debug paths
# Adjust the location pattern to match the debug routes identified in your build
location ~* ^/debug/ {
    deny all;
    return 404;
}