Description
A flaw was found in Red Hat Ansible Automation Platform's automation-
controller. A project has a signature validation credential foreign key used to
validate signed project content. Unlike the project's SCM credential, the
authorization logic does not verify that the requesting user has use permission
on the referenced credential, and the API field has no validator or type
restriction. An authenticated user holding only the organization project
administrator role can therefore bind an arbitrary credential belonging to
another organization, by its identifier, when creating or updating a project.
The controller discloses that credential's name and type in the project's
summary information and, during project synchronization, decrypts the bound
credential and uses it in the attacker-controlled project's update, allowing a
cross-tenant authorization boundary violation and information disclosure.
Published: n/a
Score: 5.0 Medium
EPSS: n/a
KEV: No
Impact: Authorization Bypass
Action: Assess Impact
AI Analysis

Impact

A flaw in Red Hat Ansible Automation Platform’s automation‑controller allows a project administrator to bind a signature‑validation credential that belongs to a different organization without verifying the administrator’s use privileges on that credential. When the project is created or updated the controller reveals the bound credential’s name and type in a project summary and later decrypts and uses the credential during project synchronization. This leads to an authorization boundary violation that exposes information about another tenant’s credentials.

Affected Systems

The vulnerability affects the automation‑controller component of Red Hat Ansible Automation Platform 2.6 running on Enterprise Linux 9. Any installation that exposes the project configuration API to an authenticated project administrator is impacted, regardless of the tenant the credential actually belongs to.

Risk and Exploitability

The CVSS score of 5.0 denotes a moderate severity, and the failure to list the vulnerability in CISA’s KEV catalog and the absence of an EPSS score suggest limited current exploitation activity. However, the bug is exploitable via the documented API by any user with project‑administrator rights, allowing cross‑tenant credential discovery and usage. The attack requires authentication but does not need elevated system privileges, making it a realistic threat for internal actors with permission to manage projects.

Generated by OpenCVE AI on September 24, 2026 at 01:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Ansible Automation Platform update that includes the fix for the signature‑validation credential authorization bug.
  • Audit existing projects to identify any that reference credentials from other organizations and reassign them to credentials owned by the same organization.
  • Revise role definitions to tighten the use_role permission for project administrators and limit cross‑tenant credential access to only those users with explicit need.
  • Enable and review logging of credential‑binding actions to detect unauthorized attempts to reference external credentials.

Generated by OpenCVE AI on September 24, 2026 at 01:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 24 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in Red Hat Ansible Automation Platform's automation- controller. A project has a signature validation credential foreign key used to validate signed project content. Unlike the project's SCM credential, the authorization logic does not verify that the requesting user has use permission on the referenced credential, and the API field has no validator or type restriction. An authenticated user holding only the organization project administrator role can therefore bind an arbitrary credential belonging to another organization, by its identifier, when creating or updating a project. The controller discloses that credential's name and type in the project's summary information and, during project synchronization, decrypts the bound credential and uses it in the attacker-controlled project's update, allowing a cross-tenant authorization boundary violation and information disclosure.
Title automation-controller: automation-controller-container: automation-controller: missing use_role authorization on the project signature validation credential foreign key allows a project administrator to bind and use another organization's credential cross-tenant
First Time appeared Redhat
Redhat ansible Automation Platform
Weaknesses CWE-639
CPEs cpe:/a:redhat:ansible_automation_platform:2.6::el9
Vendors & Products Redhat
Redhat ansible Automation Platform
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.0, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N'}

threat_severity

Moderate

Subscriptions

Redhat Ansible Automation Platform
cve-icon MITRE

No data.

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-23T00:00:00Z

Links: CVE-2026-84643 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-24T01:30:12Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key