The flaw lies in the automation‑controller instance’s install‑bundle endpoint. When an administrator downloads a node’s install bundle, the controller signs an X.509 certificate with a receptor mesh CA using the caller‑chosen hostname. The certificate has a ten‑year validity, a random serial, no revocation list, and the hostname validation is case‑insensitive while the uniqueness check is case‑sensitive. This allows an admin to register a hostname that differs only in case from an existing node and receive a mesh‑CA signed certificate that other nodes will accept as the legitimate node. The resulting long‑lived, non‑revocable credential can be used for TLS impersonation or interception between controller and nodes. The vulnerability does not grant direct remote code execution because the mesh node signing key is separate and not included in the bundle.

Red Hat Ansible Automation Platform 2 is affected. No specific version ranges are listed beyond the product line. Any release of this software that includes the install‑bundle endpoint is potentially vulnerable.

The CVSS score of 6.6 indicates a moderate impact. EPSS score not available, and the vulnerability is not in the CISA KEV list, suggesting no confirmed public exploits yet. The exploit requires a user with system‑administrator access or a similar privileged role to trigger the install‑bundle download, and an on‑path or compromised network element to leverage the forged certificate. Because the certificate is valid for ten years and cannot be revoked, an attacker could maintain long‑term control over the communication channel between control and mesh nodes if they can place themselves in the path.