A flaw in the permission logic of the automation controller causes the execute‑permission check to be performed only against the currently stored unified job template of a workflow job template node. When a node is first created with a null unified job template, the check is skipped entirely. An authenticated user with administrative rights on a single workflow job template can therefore create such an empty node and later patch it to reference any job template, project, inventory source, system job or workflow, including those belonging to other organizations. Running that workflow then executes the victim's template with the victim’s credentials, inventory and project, granting the attacker arbitrary automation execution across tenant boundaries. The patch response also discloses the name and description of the victim template. The vulnerability thus enables cross‑organization privilege escalation, potentially exposing execution privileges, configuration data, and orchestrated tasks that the attacker can misuse.

The vulnerability affects Red Hat Ansible Automation Platform version 2.6 as implemented on Enterprise Linux 9, running the automation‑controller, automation‑controller‑container and automation‑controller components.

The CVSS score of 8.5 indicates high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with workflow‑template admin privileges; it can be achieved by creating an initially empty workflow node and subsequently patching it to link an arbitrary job template, project, or workflow. The attack vector is internal to the platform – no external network exploitation is required – but the success of the exploit results in full cross‑tenant privilege escalation and bypass of access controls. Given the high CVSS score and lack of exploitation availability data, the risk is considered significant for affected environments.