EUVD-2026-69605
GHSA-xrhp-vf4q-84h8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
PR:L because exploitation requires authenticated access with specific dual role assignments; S:C because unauthorized instance group usage crosses the execution isolation boundary into separate infrastructure segments.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Ansible Automation Platform's automation-controller (AWX). The Bulk Job Launch API (POST /api/v2/bulk/job_launch/) authorizes the requested instance_groups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same field. A principal that holds read (but not use) permission on an instance group -- for example the built-in read-only System Auditor role -- together with execute permission on a job template can launch bulk jobs onto instance groups they are not authorized to use, bypassing execution-placement isolation.
AnalysisAI
Execution-placement isolation bypass in Ansible Automation Platform's automation-controller (AWX) allows authenticated principals to route bulk jobs to instance groups they lack use-level authorization for. The Bulk Job Launch API endpoint (POST /api/v2/bulk/job_launch/) enforces only a read-level permission check on the instance_groups field, whereas the standard single-job launch path correctly requires use-level permission on the same field. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated principal satisfying two simultaneous conditions: (1) read-but-not-use access on at least one target instance group-the built-in System Auditor role satisfies this by design without any non-default configuration-and (2) execute permission on at least one job template. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.4 base score with vector AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L accurately reflects moderate severity: network-reachable with low complexity, but gated behind authenticated access (PR:L) and yielding only low integrity and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-84470 for the vendor-released patch; no specific fixed version number was available in the intelligence feed and must be confirmed there before upgrade planning. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today