A bug in the automation-controller of Red Hat Ansible Automation Platform 2 allows an attacker with workflow‑admin rights to copy a workflow job template without being subject to instance_group permissions that were inherited from the original. The deep‑copy sanitizer validates only the inventory, unified_job_template, and credentials fields, neglecting instance_groups (plus execution_environment and labels). As a result, the attacker can become the administrative owner of the cloned workflow and launch jobs that target instance groups, including the control‑plane, that they are not authorized to use. This bypass of the InstanceGroup use_role check is a classic authorization flaw (CWE‑862) that can let attacker‑influenced automation run with full control‑plane privileges.

The affected product is Red Hat Ansible Automation Platform 2 supplied by Red Hat. All releases of the 2.x branch that include the automation‑controller component are impacted until the vendor releases a patch. No specific sub‑version detail is given, so the entire 2 branch is considered vulnerable.

The vulnerability scores a CVSS of 9.9, indicating high severity. EPSS is not available, but the absence of a listing in the CISA KEV catalog does not diminish the risk; the flaw can be exploited by any user with workflow‑admin rights and no instance‑group role, a capability that many administrators possess. The attack is likely to be internal or privileged, requiring possession of a valid account that is granted workflow‑admin. Once exploited, the attacker can execute arbitrary automation tasks in the control‑plane context, potentially altering system state, compromising data, or creating persistence.