Description
A flaw was found in the automation-controller API. The
unauthenticated health-check endpoint /api/v2/ping/
(ApiV2PingView, AllowAny) over-serializes RBAC-gated
automation-mesh data into its anonymous response, exposing the
full instance inventory (node hostnames, node types, UUIDs,
heartbeats, capacities, and exact versions), all instance-group
names and membership, the deployment install UUID, and the
active control node. A remote, unauthenticated attacker can use
this to map the control plane and fingerprint software versions
for targeted attacks. This flaw affects confidentiality only;
it does not expose secrets, credentials, or tenant data.
Published: 2026-09-23
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Confidentiality – disclosure of automation‑mesh topology and instance information
Action: Apply patch
AI Analysis

Impact

A vulnerability in the automation‑controller API’s public /api/v2/ping/ endpoint allows an unauthenticated attacker to receive an over‑serialized snapshot of the automation‑mesh, including node hostnames, types, UUIDs, heartbeats, capacities, exact versions, instance‑group names and membership, the deployment install UUID, and the active control node. This information exposure is limited to confidentiality; no secrets or credentials are revealed. The flaw is classified as CWE‑497, indicating that sensitive data is disclosed without proper authentication.

Affected Systems

Red Hat Ansible Automation Platform 2 is affected; all installed versions lack the fix as specific version details are not listed.

Risk and Exploitability

The CVSS score of 5.3 signals a moderate severity. EPSS is not available, so the current probability of exploitation is unknown. Because the vulnerability is remote and unauthenticated, an attacker could readily enumerate the control plane and fingerprint software versions, potentially aiding future targeted attacks. It is not present in the CISA Known Exploited Vulnerabilities catalog. The risk is primarily in information disclosure that could be used for reconnaissance.

Generated by OpenCVE AI on September 23, 2026 at 20:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Download and install the latest update for Ansible Automation Platform 2 from Red Hat to remove the exposed endpoint
  • Restrict network access to the /api/v2/ping/ endpoint by adding firewall rules that allow only trusted hosts
  • Reconfigure the environment to require authentication before exposing the health‑check or remove the public health‑check altogether

Generated by OpenCVE AI on September 23, 2026 at 20:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 24 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 06:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:ansible_automation_platform:2 cpe:/a:redhat:ansible_automation_platform:2.7::el9
References

Thu, 24 Sep 2026 04:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:ansible_automation_platform:2.5::el8
cpe:/a:redhat:ansible_automation_platform:2.5::el9
cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8
cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9
cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8
cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9
References

Thu, 24 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 23 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat ansible Automation Platform Developer
Redhat ansible Automation Platform Inside
CPEs cpe:/a:redhat:ansible_automation_platform:2.6::el10
cpe:/a:redhat:ansible_automation_platform:2.6::el9
cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10
cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9
cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9
Vendors & Products Redhat ansible Automation Platform Developer
Redhat ansible Automation Platform Inside
References

Wed, 23 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Description A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory (node hostnames, node types, UUIDs, heartbeats, capacities, and exact versions), all instance-group names and membership, the deployment install UUID, and the active control node. A remote, unauthenticated attacker can use this to map the control plane and fingerprint software versions for targeted attacks. This flaw affects confidentiality only; it does not expose secrets, credentials, or tenant data.
Title Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership
First Time appeared Redhat
Redhat ansible Automation Platform
Weaknesses CWE-497
CPEs cpe:/a:redhat:ansible_automation_platform:2
Vendors & Products Redhat
Redhat ansible Automation Platform
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Redhat Ansible Automation Platform Ansible Automation Platform Developer Ansible Automation Platform Inside
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-24T14:32:34.757Z

Reserved: 2026-09-02T00:44:46.968Z

Link: CVE-2026-84712

cve-icon Vulnrichment

Updated: 2026-09-24T14:29:39.375Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-23T20:17:17.817

Modified: 2026-09-24T21:00:46.893

Link: CVE-2026-84712

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-23T00:00:00Z

Links: CVE-2026-84712 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-24T09:00:12Z

Weaknesses
  • CWE-497

    Exposure of Sensitive System Information to an Unauthorized Control Sphere