CVE-2026-84719: Ansible Automation Platform Auth Bypass

CVE-2026-84719 Overview

A missing authorization flaw exists in the Red Hat Ansible Automation Platform automation-controller. When a user copies a WorkflowJobTemplate, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials on each cloned node. The sanitizer fails to check the instance_groups, execution_environment, and labels preserved from the original template. A user holding organization workflow-admin permission — but no role on the referenced instance groups — can copy a workflow, gain administrator rights on the copy, and launch jobs pinned to unauthorized instance groups, including the control-plane instance group.

Critical Impact

Attackers can execute automation in the control-plane execution context, bypassing the InstanceGroupuse_role boundary and influencing platform-wide automation.

Affected Products

• Red Hat Ansible Automation Platform (automation-controller component)
• See Red Hat Security Advisories RHSA-2026:71113, RHSA-2026:71114, and RHSA-2026:71115 for affected versions
• Additional impacted builds tracked in RHSA-2026:71177 and RHSA-2026:71179

Discovery Timeline

• 2026-09-23 - CVE-2026-84719 published to NVD
• 2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-84719

Vulnerability Analysis

The flaw is a missing authorization defect [CWE-862] in the workflow copy path of automation-controller. When cloning a WorkflowJobTemplate, the platform walks each node and applies a deep-copy permission sanitizer intended to strip references the copying user cannot access. The sanitizer validates only three attributes per node: inventory, unified_job_template, and credentials. Preserved attributes — instance_groups, execution_environment, and labels — bypass the authorization check entirely.

Because the copy operation grants the invoking user administrator rights on the newly created workflow, the attacker can launch the workflow immediately. Jobs run against the inherited instance_groups, including the privileged control-plane instance group, without ever holding use_role on those groups. The result is an execution-context escalation: attacker-controlled playbook logic runs where platform automation runs.

Root Cause

The deep-copy sanitizer enforces authorization on an incomplete attribute set. Fields inherited from the source WorkflowJobTemplate are trusted rather than re-validated against the copying user's role assignments, breaking the InstanceGroup use_role boundary.

Attack Vector

Exploitation requires a low-privileged authenticated account with organization workflow-admin permission. The attacker performs the following logical sequence over the network-exposed automation-controller API:

1. Identify a WorkflowJobTemplate referencing a privileged instance group such as the control plane.
2. Invoke the copy operation on the template, becoming administrator of the copy.
3. Launch the copied workflow, which executes on the inherited instance_groups without an authorization check.

No user interaction is required, and the scope changes because code runs in the control-plane execution context.

A verified proof-of-concept is not published. Technical detail is available in the Red Hat CVE Analysis for CVE-2026-84719 and Red Hat Bug Report #2527213.

Detection Methods for CVE-2026-84719

Indicators of Compromise

• Creation of a new WorkflowJobTemplate via the copy API by a user who lacks use_role on the source template's instance_groups.
• Job launches targeting the control-plane instance group originating from workflows owned by non-privileged organization admins.
• Unexpected execution_environment references appearing on newly copied workflows that the copying user could not otherwise assign.

Detection Strategies

• Audit automation-controller activity logs for workflow_job_template copy events followed within a short window by workflow_job launches.
• Correlate the launching user's InstanceGroup role assignments against the instance_groups bound to each executed workflow node.
• Alert when jobs run on the control-plane instance group from workflows created by users without a matching use_role grant.

Monitoring Recommendations

• Forward automation-controller audit logs and job event streams to a centralized analytics platform for role-versus-execution correlation.
• Track workflow copy volume per user and baseline normal behavior to detect anomalous cloning bursts.
• Monitor control-plane job execution for playbook content that deviates from platform-managed automation.

How to Mitigate CVE-2026-84719

Immediate Actions Required

• Apply the Red Hat updates referenced in RHSA-2026:71113, RHSA-2026:71114, and RHSA-2026:71115 as soon as they are available in your channel.
• Review all users holding organization workflow-admin permission and remove assignments that are not operationally required.
• Inventory WorkflowJobTemplate objects that reference the control-plane instance group and restrict which organizations can view them.

Patch Information

Red Hat has released fixes tracked under multiple advisories: RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71115, RHSA-2026:71177, and RHSA-2026:71179. Consult the Red Hat CVE page for the definitive fixed-version matrix.

Workarounds

• Restrict the workflow-admin role at the organization level to a small set of trusted operators until patches are applied.
• Remove references to the control-plane instance group from user-editable WorkflowJobTemplate objects; pin control-plane execution to platform-managed templates only.
• Disable or gate the workflow copy capability through role redesign where feasible, and audit existing copies for unauthorized instance_groups bindings.

# Example audit query against the automation-controller API
curl -sS -H "Authorization: Bearer $TOKEN" \
  "https://controller.example.com/api/v2/workflow_job_templates/?created__gte=2026-09-01" \
  | jq '.results[] | {id, name, summary_fields: .summary_fields.created_by, instance_groups: .related.instance_groups}'