An SSRF flaw exists in the Automation Controller email notification backend. When an authenticated organization user with notification‑admin privileges creates or edits an email template, the supplied SMTP host and port are passed directly to the SMTP client without validation. Triggering a test causes the controller to open a raw TCP connection to the indicated address, and the resulting connection error is returned through the notification record. This behavior provides a three‑state oracle of whether an internal, loopback, link‑local, or reserved address is open, closed, or filtered, and, if the template contains a stored SMTP password, can leak that credential to an attacker‑controlled server.

Red Hat Ansible Automation Platform 2, specifically the Automation Controller component. All releases in the 2 major version are affected; no more specific version constraints are provided.

The CVSS base score of 6.4 indicates moderate severity. The EPSS score is currently unavailable, indicating no publicly documented exploitation yet, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access with notification‑admin rights, but once achieved it can be used to map internal services and exfiltrate SMTP credentials. While it does not grant arbitrary code execution, the ability to probe the internal cluster network and leak secrets can facilitate a larger compromise.