The vulnerability allows an authenticated user that is only permitted to launch a single job template to submit a bulk job launch request that includes a workflow node referencing any unified job in any organization. Because the node’s job reference is writable and bypasses permission checks, the attacker can read the referenced job’s metadata and, by cancelling the workflow, cancel the referenced job. Repeating this process grants the attacker the ability to interrupt running jobs, project and inventory syncs, ad‑hoc commands, and system jobs throughout the entire automation platform, leading to a platform‑wide denial of service and accidental exposure of job data.

Red Hat Ansible Automation Platform automation-controller containers and components, specifically version 2.6 running on Enterprise Linux 9. The flaw is present in the bulk job launch endpoint that serializes client input into workflow job nodes and does not enforce permission validation on the job reference field.

The flaw receives a CVSS score of 8.5, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated HTTP request to the bulk job launch API; the attacker needs the minimal privilege of executing a single job template. Given the high CVSS score and absence of mitigation through standard controls, the risk to affected installations is significant and exploitation could result in widespread denial of service and accidental disclosure of credentials or configuration data across all organizations that use the platform.