CVE-2026-84712: Automation Controller API Data Exposure

CVE-2026-84712 Overview

CVE-2026-84712 is an information disclosure vulnerability in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes role-based access control (RBAC) gated automation-mesh data into its anonymous response. Remote, unauthenticated attackers can retrieve full instance inventory, node hostnames, node types, UUIDs, heartbeats, capacities, exact software versions, instance-group names and membership, the deployment install UUID, and the active control node. This affects confidentiality only and does not expose secrets, credentials, or tenant data. The weakness is tracked under [CWE-497] (Exposure of Sensitive System Information to an Unauthorized Control Sphere).

Critical Impact
Unauthenticated attackers can enumerate the automation controller control plane and fingerprint exact software versions to plan targeted follow-on attacks.

Affected Products

Red Hat Ansible Automation Platform (automation-controller component) — see Red Hat CVE Report CVE-2026-84712
Fixed builds distributed via RHSA-2026:71113 and RHSA-2026:71114
Additional fixed builds released in RHSA-2026:71177 and RHSA-2026:71179

Discovery Timeline

2026-09-23 - CVE-2026-84712 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-84712

Vulnerability Analysis

The flaw resides in the ApiV2PingView handler exposed at /api/v2/ping/. This endpoint is designed as an anonymous health-check probe and applies the AllowAny permission class. The response serializer includes automation-mesh topology fields that should only be visible to authenticated users with appropriate RBAC scope. Because the serializer runs regardless of the caller's identity, sensitive operational metadata is returned to unauthenticated clients.

Exposed fields include node hostnames, node types, UUIDs, heartbeat timestamps, capacity values, exact controller versions, instance-group names and membership lists, the deployment install UUID, and the identifier of the active control node. An attacker who reaches the controller over the network can enumerate the control plane and correlate exposed version strings against known vulnerabilities to plan targeted attacks.

Root Cause

The root cause is over-serialization at an unauthenticated boundary. The ping serializer includes RBAC-gated data without filtering the response payload based on the requester's authentication state or authorization scope. See the Red Hat Bug Report #2527196 for tracking details.

Attack Vector

Exploitation is trivial. An attacker issues an unauthenticated HTTP GET request to /api/v2/ping/ on a network-reachable automation-controller instance and parses the JSON response for mesh topology fields. No credentials, user interaction, or preconditions are required beyond network access to the controller's API. The vulnerability affects confidentiality only; integrity and availability are not impacted.

No verified public exploit code is available. Refer to the Red Hat CVE Report CVE-2026-84712 for the authoritative technical description.

Detection Methods for CVE-2026-84712

Indicators of Compromise

Unauthenticated HTTP GET requests to /api/v2/ping/ originating from unexpected source addresses or automation frameworks.
Response payloads from the ping endpoint containing fields such as instances, instance_groups, install_uuid, or active_node returned to anonymous clients.
Sudden spikes in traffic to the ping endpoint from a single external IP that also targets other management APIs.

Detection Strategies

Inspect web server and reverse proxy logs for requests to /api/v2/ping/ and flag those without an Authorization header or valid session cookie.
Correlate requests to the ping endpoint with subsequent scanning activity against controller nodes identified in the response.
Baseline legitimate health-check traffic sources (load balancers, monitoring systems) and alert on out-of-baseline callers.

Monitoring Recommendations

Enable verbose access logging on the automation-controller front-end proxy and forward logs to a central analytics platform.
Add alerting rules for anonymous access to /api/v2/ping/ from any address outside the approved monitoring subnet.
Track version strings and instance-group names appearing in outbound response bodies for external clients.

How to Mitigate CVE-2026-84712

Immediate Actions Required

Apply the Red Hat security updates published in RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71177, and RHSA-2026:71179.
Restrict network access to the automation-controller API so that only trusted management networks and monitoring hosts can reach /api/v2/ping/.
Audit historical logs for unauthenticated access to the ping endpoint and identify any external callers that received full mesh metadata.

Patch Information

Red Hat has released fixed builds through advisories RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71177, and RHSA-2026:71179. Consult the Red Hat CVE Report CVE-2026-84712 for the current list of fixed package versions.

Workarounds

Place the automation-controller behind an authenticating reverse proxy that requires client certificates or an API token for access to /api/v2/ping/.
Restrict /api/v2/ping/ at the load balancer to source IPs used by internal monitoring and block external reachability until patches are applied.
Remove or redact automation-mesh fields from any custom health-check integrations that expose the ping response externally.

bash

# Example NGINX restriction limiting the ping endpoint to a monitoring subnet
location = /api/v2/ping/ {
    allow 10.0.20.0/24;
    deny all;
    proxy_pass http://automation_controller_upstream;
}