Vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8

[ Description ]Official description

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory (node hostnames, node types, UUIDs, heartbeats, capacities, and exact versions), all instance-group names and membership, the deployment install UUID, and the active control node. A remote, unauthenticated attacker can use this to map the control plane and fingerprint software versions for targeted attacks. This flaw affects confidentiality only; it does not expose secrets, credentials, or tenant data.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund23 Sep 2026WID-SEC-2026-3555

  Red Hat Ansible Automation Platform (automation-controller): Multiple vulnerabilities Translated from German

  CVE-2026-84713CVE-2026-71459CVE-2026-84475+58 more CVEs

[ References ]References

• access.redhat.com/errata/RHSA-2026:71113
• access.redhat.com/errata/RHSA-2026:71114
• access.redhat.com/errata/RHSA-2026:71177
• access.redhat.com/errata/RHSA-2026:71179
• access.redhat.com/security/cve/CVE-2026-84712
• bugzilla.redhat.com/show_bug.cgi