Ansible Automation Platform CVE-2026-6266

Requires AAP gateway 2.6 with user auto-link strategy enabled for external Identity Provider integration. Attacker must successfully authenticate to at least one IDP that AAP trusts for federated authentication, meaning the attacker needs valid credentials to any integrated IDP (corporate SAML, OAuth provider, etc.). The IDP must permit account creation with arbitrary email addresses without requiring email verification, or the attacker must compromise an existing IDP account. Target victim must have an existing AAP user account that has not yet been linked to an IDP identity. The attack targets the specific gap where AAP accepts IDP-provided email claims as authoritative without independent verification. Does not require network proximity to AAP servers, user interaction, or non-default AAP configuration beyond having external IDP integration enabled, which is a common enterprise deployment pattern.

This vulnerability presents significant real-world risk despite requiring low-privilege authentication (PR:L). The CVSS score of 8.3 reflects high confidentiality and integrity impact with network-based attack vector and low complexity. The key risk factor is the potential for administrative account compromise through a feature designed for legitimate federated authentication workflows. An authenticated attacker with access to any external IDP integrated with AAP can target high-value accounts including administrators by creating IDP accounts with matching email addresses. The unchanged scope (S:U) indicates the vulnerability is contained within AAP's authorization boundary, but the ability to escalate from low-privilege to administrative access represents a critical privilege escalation path. Without EPSS or KEV data, we cannot confirm active exploitation, but the presence of a Red Hat security advisory (RHSA-2026:13508) and the straightforward exploitation path suggest this is being addressed as a high-priority issue. The attack requires existing authentication to some IDP account, which partially limits opportunistic exploitation, but organizations with open IDP registration or compromised IDP accounts face immediate risk. Priority should be highest for environments where AAP manages critical infrastructure automation with privileged access.

An attacker with access to any external Identity Provider integrated with AAP 2.6 (such as corporate SAML, Google OAuth, or GitHub) creates a new IDP account using the email address of a target AAP administrator, for example admin@victim-company.com, without actually controlling that email inbox. The attacker authenticates to AAP through this IDP account. The AAP gateway's auto-link feature matches the IDP-provided email to the existing admin@victim-company.com AAP account and automatically links them without email verification. The attacker now has full administrative access to AAP with the ability to modify automation playbooks, access credentials, and control managed infrastructure.