CVE-2026-84721: Ansible Automation Platform SSRF Vulnerability

CVE-2026-84721 Overview

CVE-2026-84721 is a server-side request forgery (SSRF) vulnerability in the Red Hat Ansible Automation Platform automation-controller email notification backend. The email backend forwards user-supplied SMTP host and port values from a notification template directly to the SMTP client. It never validates that the target is not an internal, loopback, link-local, or reserved address. An authenticated user holding the organization notification-admin permission can point a notification at an arbitrary internal address and trigger a test to probe the control-plane network.

Critical Impact
Authenticated attackers can perform internal port scanning across the cluster network, including the in-cluster Kubernetes API, and exfiltrate stored SMTP credentials to attacker-controlled hosts.

Affected Products

Red Hat Ansible Automation Platform
automation-controller email notification backend
Refer to Red Hat Security Advisory RHSA-2026:71177 for affected build versions

Discovery Timeline

2026-09-23 - CVE-2026-84721 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-84721

Vulnerability Analysis

The flaw resides in the automation-controller email notification backend. The backend accepts SMTP host and port parameters from a notification template and passes them unchecked to the SMTP client. The controller task process then opens a raw TCP connection to whatever destination the notification template specifies. This provides an authenticated attacker with a primitive to reach services that should not be exposed on the control-plane network.

Because connection errors are reflected back into the notification record, the attacker receives a three-state oracle indicating whether a probed port is open, closed, or filtered. The oracle enables systematic port scanning of internal services, including the in-cluster Kubernetes API endpoint. Where an organization template contains a stored SMTP password, redirecting the host also causes the credential to be transmitted to the attacker-controlled destination during the SMTP handshake.

Root Cause

The underlying weakness is classified as [CWE-918] Server-Side Request Forgery. The notification backend performs no allow-list or deny-list validation on the destination address. Internal ranges such as loopback (127.0.0.0/8), link-local (169.254.0.0/16), and RFC1918 space are treated identically to legitimate external SMTP relays.

Attack Vector

Exploitation requires an authenticated account with the organization notification-admin role. The attacker creates or modifies an email notification template, setting the SMTP host to an internal target and the port to the service under probe. Triggering a test notification causes the controller to initiate a TCP connection. The resulting success, refusal, or timeout is stored in the notification record and read back by the attacker to infer service state.

No verified public exploit code is available. See the Red Hat CVE CVE-2026-84721 Detail page for advisory-level technical detail.

Detection Methods for CVE-2026-84721

Indicators of Compromise

Email notification templates configured with SMTP hosts pointing to internal, loopback, link-local, or reserved IP ranges.
Repeated test notification events from a single user targeting varying SMTP host or port combinations.
Outbound TCP connections from automation-controller task pods to the Kubernetes API service address or other in-cluster endpoints.

Detection Strategies

Audit automation-controller notification template create and update events for SMTP host values matching private, loopback, or link-local address ranges.
Correlate notification-admin role activity with subsequent test-notification API calls to identify scanning behavior.
Monitor egress from controller task processes for TCP connections to non-SMTP ports (anything other than 25, 465, 587).

Monitoring Recommendations

Forward automation-controller audit logs and notification job records to a centralized analytics platform for behavioral review.
Alert on notification test volumes that exceed baseline for a given user or organization.
Track Kubernetes API server access logs for unexpected source pods originating from the controller namespace.

How to Mitigate CVE-2026-84721

Immediate Actions Required

Apply the fixes described in Red Hat Security Advisory RHSA-2026:71177 to all automation-controller instances.
Review existing email notification templates and remove any pointing to internal, loopback, or reserved addresses.
Rotate any SMTP credentials that were stored in shared organization notification templates.

Patch Information

Red Hat has published updated packages through RHSA-2026:71177. Additional tracking information is available in Red Hat Bug Report 2527220 and the Red Hat CVE detail page.

Workarounds

Restrict the organization notification-admin permission to a minimal set of trusted operators until the patch is applied.
Apply network egress policies on the controller namespace that permit only known SMTP relay destinations on ports 25, 465, and 587.
Enforce Kubernetes NetworkPolicy rules preventing controller task pods from reaching the Kubernetes API service and other sensitive in-cluster endpoints.

bash

# Configuration example
# Example Kubernetes NetworkPolicy restricting egress from controller task pods
# Apply in the automation-controller namespace after review
kubectl apply -f - <<'EOF'
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: controller-egress-smtp-only
  namespace: aap
spec:
  podSelector:
    matchLabels:
      app: automation-controller-task
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 10.0.0.0/8
        - 172.16.0.0/12
        - 192.168.0.0/16
        - 127.0.0.0/8
        - 169.254.0.0/16
    ports:
    - protocol: TCP
      port: 25
    - protocol: TCP
      port: 465
    - protocol: TCP
      port: 587
EOF