CVE-2026-84717: Ansible Automation Platform Information Disclosure

CVE-2026-84717 Overview

CVE-2026-84717 is an information disclosure vulnerability in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after performing the target template lookup. The endpoint returns HTTP 200 when a template has a Bitbucket DC webhook configured and HTTP 403 otherwise. An unauthenticated remote attacker can leverage this response discrepancy as an oracle to enumerate Job Template and Workflow Job Template IDs configured with Bitbucket DC webhooks, without possessing the secret webhook_key. The weakness is classified as observable response discrepancy [CWE-204].

Critical Impact
Unauthenticated attackers can enumerate internal Job Template and Workflow Job Template identifiers over the network, exposing automation surface for follow-on attacks.

Affected Products

Red Hat Ansible Automation Platform (automation-controller component)
Job Template endpoints with Bitbucket Data Center webhook integrations
Workflow Job Template endpoints with Bitbucket Data Center webhook integrations

Discovery Timeline

2026-09-23 - CVE-2026-84717 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-84717

Vulnerability Analysis

The automation-controller exposes an unauthenticated webhook receiver for Bitbucket Data Center integrations. The receiver validates HMAC signatures for standard payloads, but treats diagnostics:ping events differently. For ping events, the controller first resolves the target Job Template or Workflow Job Template by ID, then bypasses HMAC verification. If the template exists and has a Bitbucket DC webhook configured, the endpoint responds with HTTP 200. If the template does not exist or lacks the integration, it returns HTTP 403.

This observable response difference converts the endpoint into an enumeration oracle. Attackers iterating through numeric template IDs can distinguish valid webhook-enabled templates from invalid or unconfigured ones without knowing the webhook_key secret. The disclosure exposes internal automation topology and identifies high-value automation targets tied to source-code events.

Root Cause

The root cause is an authorization ordering flaw. The controller performs the template lookup before enforcing HMAC signature verification for diagnostics:ping events. Because the response code differs based on whether the lookup succeeded, the endpoint leaks the existence of specific template IDs to unauthenticated clients [CWE-204].

Attack Vector

Exploitation requires only network reachability to the automation-controller webhook receiver endpoint. An attacker crafts HTTP POST requests to the Bitbucket DC webhook URL with a diagnostics:ping event body and iterates numeric template identifiers. Distinguishing HTTP 200 from HTTP 403 responses reveals which Job Template and Workflow Job Template IDs have Bitbucket DC webhooks configured. No credentials, webhook_key, or user interaction are required.

Full technical detail is available in the Red Hat CVE Details for CVE-2026-84717 and the Red Hat Bug Report #2527210.

Detection Methods for CVE-2026-84717

Indicators of Compromise

Sequential or high-volume POST requests to Bitbucket Data Center webhook receiver endpoints from a single source IP.
Requests containing diagnostics:ping event payloads without valid HMAC signatures.
Web server logs showing alternating HTTP 200 and HTTP 403 responses across incrementing template ID paths.

Detection Strategies

Baseline legitimate Bitbucket DC webhook traffic by source IP and event type, then alert on deviations targeting multiple template IDs.
Correlate unauthenticated webhook POST requests with subsequent authenticated activity against the enumerated template IDs.
Inspect reverse proxy or load balancer logs for enumeration patterns preceding known Ansible Automation Platform endpoints.

Monitoring Recommendations

Forward automation-controller and web-tier access logs to a centralized analytics platform for pattern analysis.
Enable rate limiting and anomaly alerting on the webhook receiver URI path.
Track the volume of HTTP 403 responses returned by webhook endpoints as an enumeration signal.

How to Mitigate CVE-2026-84717

Immediate Actions Required

Apply the vendor-supplied updates referenced in Red Hat Security Advisories RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71177, and RHSA-2026:71179.
Restrict inbound network access to the automation-controller webhook receiver so that only trusted Bitbucket Data Center source addresses can reach it.
Audit existing Job Templates and Workflow Job Templates for Bitbucket DC webhook configurations and rotate webhook_key values where enumeration is suspected.

Patch Information

Red Hat has published fixes through the following advisories: RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71177, and RHSA-2026:71179. Administrators should update automation-controller to the patched release matching their Ansible Automation Platform version and validate that the fix enforces HMAC verification before performing template lookups for diagnostics:ping events.

Workarounds

Place the webhook receiver behind a reverse proxy that enforces IP allow-listing for known Bitbucket Data Center egress addresses.
Deploy a web application firewall rule to drop diagnostics:ping payloads lacking a valid signature header.
Monitor and rate-limit unauthenticated requests to the webhook endpoint until patching is complete.

bash

# Example nginx allow-list snippet for the webhook receiver
location /api/v2/bitbucket_dc/ {
    allow 10.0.0.0/8;        # trusted Bitbucket DC egress
    deny  all;
    proxy_pass http://automation_controller_upstream;
}