CVE-2026-84716: Automation Controller Privilege Escalation

CVE-2026-84716 Overview

A flaw in the Red Hat automation-controller install-bundle endpoint allows an administrator to obtain a receptor mesh certificate authority (CA) signed certificate that impersonates an existing control node. The hostname charset validator is case-insensitive while the uniqueness validator is case-sensitive. An administrator can register a case variant of an existing control node hostname and receive a long-lived, non-revocable mesh peer credential. In managed or hosted deployments where the customer holds controller superuser but the platform operator runs the mesh, this enables TLS impersonation or interception of control and hybrid mesh nodes. This flaw is tracked under [CWE-266: Incorrect Privilege Assignment].

Critical Impact
Attackers with controller superuser and an on-path network position can impersonate control nodes over the receptor mesh using a ten-year, non-revocable certificate.

Affected Products

Red Hat Ansible Automation Platform (automation-controller component)
Receptor mesh nodes signed by the controller's mesh CA
Managed and hosted automation-controller deployments

Discovery Timeline

2026-09-23 - CVE-2026-84716 published to the National Vulnerability Database
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-84716

Vulnerability Analysis

When a System Administrator downloads an execution or hop node install bundle, the automation-controller signs an X.509 certificate using the receptor mesh CA. The Common Name, DNS subject-alternative-name, and receptor node-id are taken verbatim from the caller-chosen instance hostname. The certificate is issued with a hard-coded ten-year validity, a random serial, no issuance log, and no revocation list.

The flaw is a case-sensitivity mismatch between two validators. The hostname charset validator is case-insensitive, while the uniqueness validator is case-sensitive. This lets an administrator register a case variant of an existing control node hostname. TLS peers match hostnames case-insensitively and accept the resulting certificate as the legitimate control node.

The issue does not grant direct remote code execution. Receptor work submission is gated by a separate signing key that is not included in the install bundle.

Root Cause

The root cause is inconsistent case handling between validation layers combined with weak certificate lifecycle controls. The uniqueness check treats Control-Node and control-node as distinct identifiers. The TLS hostname matching layer treats them as equivalent. The absence of an issuance log and revocation list means any signed certificate remains trusted for its full ten-year lifetime.

Attack Vector

An attacker requires controller superuser privileges and network positioning on the receptor mesh path. The attacker registers an instance with a case variant of a target control node hostname, downloads the install bundle, and extracts the mesh-CA-signed certificate. With an on-path position, the attacker presents this certificate to peer nodes to perform TLS impersonation or interception of control and hybrid mesh traffic. Refer to the Red Hat CVE Analysis for CVE-2026-84716 for full technical details.

Detection Methods for CVE-2026-84716

Indicators of Compromise

Newly registered controller instances whose hostnames differ from existing control nodes only by letter case
Receptor mesh certificates issued with ten-year validity signed after unexpected install-bundle downloads
Duplicate node identifiers appearing in mesh peer TLS handshakes with mismatched source IP addresses
Unexplained TLS session establishments between mesh peers and unknown network endpoints

Detection Strategies

Audit the controller instance registry for hostnames that collide with existing entries under case-insensitive comparison
Correlate install-bundle endpoint access logs with subsequent mesh peer certificate presentation events
Monitor receptor mesh TLS handshakes for the same node-id appearing from multiple network locations

Monitoring Recommendations

Enable verbose audit logging on the automation-controller API for install-bundle requests and instance creation events
Aggregate receptor mesh connection metadata into a central log store for cross-node correlation
Alert on any newly issued mesh CA certificate and require reconciliation against an approved node inventory

How to Mitigate CVE-2026-84716

Immediate Actions Required

Apply the patches referenced in RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71177, and RHSA-2026:71179
Enumerate all instance hostnames in the controller and identify any case-variant collisions with control nodes
Restrict controller superuser access in managed deployments to reduce the population of accounts that can request install bundles
Rotate the receptor mesh CA if unauthorized case-variant instances are found

Patch Information

Red Hat has published security advisories addressing this flaw. Consult the Red Hat CVE Analysis for CVE-2026-84716 and the Red Hat Bug Report #2527199 for affected package versions and remediation steps.

Workarounds

Enforce case-insensitive uniqueness on instance hostnames through operational review before applying fixes
Segment the receptor mesh network to limit on-path attacker positioning between control and hybrid nodes
Require multi-party approval for install-bundle downloads in managed and hosted deployments
Track all mesh CA issued certificates in an external inventory to compensate for the missing issuance log

bash

# Configuration example: audit controller instances for case-variant collisions
awx-manage shell_plus -c "from main.models import Instance; \
seen = {}; \
[seen.setdefault(i.hostname.lower(), []).append(i.hostname) for i in Instance.objects.all()]; \
[print('COLLISION:', v) for v in seen.values() if len(v) > 1]"