CVE-2026-84502 – Red Hat Ansible Automation Platform 2.4 for RHEL 8
“When the platform that runs your automation can be turned against you, every managed host becomes the attacker's next stop.”
This update fixes four Critical flaws in the automation controller and container groups of Red Hat Ansible Automation Platform 2.4 for RHEL 8. CVE-2026-75884 has a CVSS score of 9.1, Critical severity. CVE-2026-84474 has a CVSS score of 9.9, Critical severity. CVE-2026-84502 has a CVSS score of 9.9, Critical severity. CVE-2026-84719 has a CVSS score of 9.9, Critical severity.
The fixes close several ways to break out of assigned privileges. An incomplete blocklist on pod spec overrides lets an administrator reach OpenShift namespace secrets. An exposed provisioning-callback secret, combined with a trusted X-Forwarded-For header, lets a low-privileged or unauthenticated attacker launch jobs against managed hosts. An unvalidated project SCM URL allows arbitrary command execution on the control-plane task pod. A gap in workflow copy checks lets a user run jobs on instance groups they are not authorized to use, including the control plane. Together, these flaws put credentials, managed hosts, and tenant isolation at direct risk.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- Low
- User Interaction
- None
- CWE Classification
- CWE-88