---
id: CVE-2026-84486
title: |-
  A flaw was found in Red Hat Ansible Automation Platform's automation-
  controller
summary: >-
  A flaw was found in Red Hat Ansible Automation Platform's automation-

  controller. Four debug views that trigger the internal task, dependency, and

  workflow schedulers are configured to allow any user (including
  unauthenticated

  clients) a…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'
cwe:
  - CWE-489
vendor: Red Hat
product: automation-controller
affected:
  - automation-controller (all versions)
  - ansible-automation-platform-26/controller-rhel9 (all versions)
  - ansible-automation-platform-27/controller-rhel9 (all versions)
published: '2026-09-23'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T06:17:02.153'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84486'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:71113'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:71177'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:71179'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2026-84486'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2527085'
    label: secalert@redhat.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84486.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-84486'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84486'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-23T19:26:33.390389Z'
ingestedAt: '2026-09-23T19:31:04.469Z'
patched:
  - ansible_automation_platform_2_6_for_rhel 9
  - ansible_automation_platform 2.6
  - ansible_automation_platform 2.7
epss: 0.00524
epssPercentile: 0.41946
---

## Overview

A flaw was found in Red Hat Ansible Automation Platform's automation-
controller. Four debug views that trigger the internal task, dependency, and
workflow schedulers are configured to allow any user (including unauthenticated
clients) and are routed in production builds because their URL include is not
gated on the debug setting. An unauthenticated remote attacker can repeatedly
invoke these endpoints to acquire the cluster-wide scheduler advisory lock;
because the legitimate scheduler acquires the same lock without waiting, the
attacker causes real scheduler runs to be skipped, stalling job dispatch for
all tenants, while also consuming controller web workers. The debug root view
additionally discloses the list of debug endpoints to unauthenticated callers.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:71113** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71113)
- **RHSA-2026:71179** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71179)
- **RHSA-2026:71177** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71177)