Ansible Automation Platform CVE-2026-84474

Exploitation requires the controller to be deployed behind the AAP gateway with an EMPTY proxy allow-list, which causes the provisioning-callback endpoint to trust the client-supplied X-Forwarded-For header; a non-empty/correct proxy allow-list defeats the host-spoofing step. The attacker must also obtain the host_config_key, which is exposed to anyone holding read-only view_jobtemplate permission (or via the activity stream) - so the practical prerequisite is either that low-privilege read access or, per the description, an unauthenticated path in the misconfigured-gateway case. The target job template must have provisioning callback enabled and inventory hosts with usable credentials. Limiting factors: the empty-allow-list gateway configuration is the key non-default enabler, and provisioning callbacks must be in use.

This is a genuine top-priority vulnerability, not high-CVSS-but-low-risk. The vendor CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is well-supported: it chains a secret-disclosure flaw (host_config_key exposed to read-only view_jobtemplate holders, and in the activity stream) with a trust-boundary flaw (provisioning-callback endpoint trusting a client-supplied X-Forwarded-For when the gateway proxy allow-list is empty), yielding RCE on managed hosts using the job template's own credentials. CWE-807 (reliance on untrusted inputs in a security decision) precisely describes the X-Forwarded-For trust. The scope change (S:C) is justified because compromise of the controller-side callback is leveraged to execute code on separate managed hosts. Note a conflict worth flagging: the description says a 'minimally privileged OR unauthenticated remote attacker' can exploit this, yet the vector encodes PR:L - if a deployment truly exposes the secret or callback without any authentication, the real score approaches 10.0/PR:N; PR:L reflects the common case where view_jobtemplate is needed to read the secret. EPSS, CISA KEV status, and POC availability are all absent from the input, so exploitation likelihood is unquantified; SSVC fields were not provided. No public exploit is identified at time of analysis. Because this is Red Hat self-reported with a Bugzilla tracker (2527073) but no independent exploitation evidence, treat it as a critical patch-now issue driven by impact severity rather than by confirmed in-the-wild activity.

An attacker with only read-level view_jobtemplate access (or, per the description, potentially unauthenticated in a misconfigured gateway deployment) reads the provisioning-callback host_config_key from the job template API or activity stream. They then POST to the provisioning-callback endpoint while spoofing the X-Forwarded-For header to match a host in the template's inventory, triggering the job template to run against that managed host with the template's stored credentials - achieving remote code execution. No public exploit code is identified at time of analysis, but the attack is low-complexity (AC:L) and requires no user interaction.