An unauthenticated flaw in the Ansible Automation Platform automation-controller allows a remote attacker to send requests to the Bitbucket Data Center webhook receiver. The receiver skips HMAC signature verification for diagnostics:ping events once it has looked up the target template, returning HTTP 200 for templates that have a Bitbucket DC webhook configured and HTTP 403 otherwise. This response difference acts as an oracle, enabling the attacker to discover which Job Template and Workflow Job Template IDs have Bitbucket DC webhooks enabled without knowing the secret webhook_key. The vulnerability is a form of Information Exposure (CWE‑204) that can reveal operational details and reduce the obscurity of the system.

Red Hat Ansible Automation Platform 2. No specific version range is provided; the affected product is the automation-controller component of this platform.

The CVSS score of 5.3 indicates medium severity, while the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog. An attacker does not need authentication and can exploit the flaw from any network that can reach the webhook endpoint, making the attack likely to be remote. The exploitation requires only sending simple HTTP requests and parsing the 200/403 status code, and the impact of revealing internal job template identifiers is high enough to warrant attention.