Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2026-84638

critical

CVE-2026-84638

automation-controller: automation-controller-container: automation-controller: instance group attachment to schedules and workflow job template nodes checks only read permission, allowing use of restricted (controlplane / other-tenant) instance groups and privilege escalation to control-plane code execution

In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

Red Hat9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by Red Hat.

Description

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching an instance group to a schedule or a workflow job template node through the dedicated API relationship endpoint, the controller verifies only that the requesting user can read (view) the instance group, rather than that they hold use permission on it, unlike every other instance group assignment in the product. An authenticated user with read-only visibility of an instance group -- for example a system auditor -- can attach a use-restricted instance group, including the control plane group or another tenant's container group, to a schedule or workflow node they control. Their playbook then executes on the control plane node or within another tenant's execution environment, leading to privilege escalation and, in the control plane case, full compromise of the platform.

Affected packages and fixed versions

No package source lists this ID.

References

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.