EUVD-2026-85548
GHSA-jr99-3x99-6q34
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach controller web interface unauthenticated
-
DeliveryQuery debug root view for endpoint list
-
ExploitRepeatedly invoke debug scheduler endpoints
-
ExecutionContend cluster-wide advisory lock
-
PersistLegitimate scheduler runs skipped, workers exhausted
-
ImpactCluster-wide job dispatch stalls for all tenants
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default production builds of Red Hat Ansible Automation Platform automation-controller, because the four debug scheduler endpoints' URL include is not gated on the debug setting and permits any user including unauthenticated clients. The only prerequisite is network reachability to the automation-controller web service. Limiting factors are minimal: exploitation requires no authentication, no user interaction, and no non-default configuration; the main practical limiter is network segmentation restricting who can reach the controller's web tier, plus knowledge of the endpoint paths (which the unauthenticated debug root view itself discloses). |
| Impact | This is a genuine operational-availability priority, not a high-CVSS-but-low-real-risk paper cut. The CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) is internally consistent with the description: fully remote, low-complexity, no authentication and no user interaction, with high availability impact and low confidentiality impact. The A:H is well-justified because the flaw stalls job dispatch for ALL tenants on a shared automation-controller cluster and exhausts web workers, and C:L reflects the debug-root view leaking the list of debug endpoints. The most dangerous factor is that these debug scheduler endpoints are routed in PRODUCTION builds by default (the URL include is not gated on the debug setting), so no misconfiguration is needed. Signals are limited: no EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - but the trivial trigger (repeatedly hitting a URL) means weaponization would be simple if endpoint paths become known. No SSVC decision data was supplied. The only mild conflict is the 'Information Disclosure' tag, which understates the vulnerability since the dominant impact is denial of service (A:H), not confidentiality. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach the automation-controller web interface repeatedly requests the four debug scheduler endpoints (discovered via the unauthenticated debug root view that lists them), each request forcing acquisition of the cluster-wide scheduler advisory lock. Because the legitimate scheduler takes the same lock without waiting, real scheduler runs are silently skipped, halting job dispatch for every tenant while controller web workers are tied up. No public POC is identified in the available data, but the attack requires only repeated HTTP requests with no authentication or special tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Unauthenticated remote attackers can stall job dispatch for every tenant on Red Hat Ansible Automation Platform 2 by repeatedly calling four debug scheduler views that are routed in production builds because their URL include is not gated on the debug setting. Each call lets any network-reachable client acquire the cluster-wide scheduler advisory lock, and since the legitimate scheduler takes that same lock without waiting, genuine scheduler runs are skipped, job dispatch is delayed or halted, and controller web workers are consumed. The debug root view also discloses the list of debug endpoints to unauthenticated callers, and no public exploit code has been identified at time of analysis.
RemediationAI
No vendor-released patch was identified at time of analysis; Red Hat's CVE page (https://access.redhat.com/security/cve/CVE-2026-84486) and Bugzilla 2527085 (https://bugzilla.redhat.com/show_bug.cgi?id=2527085) should be monitored for the fixed automation-controller build and the exact errata version, which should be applied as soon as it is published. Until then, the most effective compensating control is to block the debug scheduler views, and the debug root view that enumerates them, at the ingress layer - a reverse proxy, load balancer, or WAF rule returning 403/404 for those paths - since the routes resolve in production regardless of the debug setting; the trade-off is that operators must maintain the path deny-list and it depends on the proxy being the only path to the controller. Strongly restrict network reachability to the automation-controller web tier with firewall rules or security groups limited to trusted administrative networks, which removes the unauthenticated attack surface but also blocks legitimate user and integration traffic from outside those ranges. Where the deployment is self-managed, consider removing or commenting out the debug URL include and rebuilding, accepting that this is an unsupported local modification that may be reverted by upgrades. Detectively, alert on repeated or abnormal requests to debug-style endpoint paths or on sudden scheduler stalls and web-worker saturation, understanding that this only shortens response time and does not prevent the outage.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is classified under CWE-489 (Active Debug Code): development/debug-only views were left reachable in production deployments of the Ansible Automation Platform automation-controller. Four debug views exist that trigger the internal task, dependency, and workflow schedulers; their URL include is not conditioned on the debug setting, so the routes resolve in normal production builds and are configured to accept any user, including unauthenticated clients. The schedulers coordinate across the cluster with a single advisory lock, and the legitimate scheduler path acquires that lock without waiting - so an attacker who holds or repeatedly re-acquires it causes real scheduler runs to be skipped rather than queued. The same requests tie up controller web workers, compounding the availability impact. The debug root view additionally enumerates the debug endpoints for unauthenticated callers, which is the source of the limited confidentiality impact. The CPE records (cpe:2.3:a:red_hat:red_hat_ansible_automation_platform_2:*:*:*:*:*:*:*:*) use wildcard versions, so the supplied data does not constrain the issue to a specific automation-controller release. Under the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, exploitation requires only network reachability to the automation-controller web tier: no authentication, no user interaction, and no non-default configuration.
Know when Red Hat Ansible Automation Platform 2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Remote, trivial, unauthenticated trigger with no user interaction; cluster-wide job-dispatch denial gives A:H, endpoint-list disclosure gives C:L, no integrity impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views that trigger the internal task, dependency, and workflow schedulers are configured to allow any user (including unauthenticated clients) and are routed in production builds because their URL include is not gated on the debug setting. An unauthenticated remote attacker can repeatedly invoke these endpoints to acquire the cluster-wide scheduler advisory lock; because the legitimate scheduler acquires the same lock without waiting, the attacker causes real scheduler runs to be skipped, stalling job dispatch for all tenants, while also consuming controller web workers. The debug root view additionally discloses the list of debug endpoints to unauthenticated callers.
Executive ViewAI
Red Hat Ansible Automation Platform 2 has a high-severity availability flaw that can delay or halt automated job dispatch for every tenant on an affected controller, disrupting scheduled and on-demand automation across the organization. Repeated requests to four debug scheduler views can consume controller web workers and cause legitimate scheduler runs to be skipped, with no public exploit identified at time of analysis. Because no vendor-released patch has been identified, leadership should prioritize reducing network exposure and monitoring for scheduler and worker degradation.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network reachability to the controller and the affected debug scheduler endpoints, blocking the four debug view paths at a reverse proxy, load balancer, or WAF, removing or gating the debug URL include in production builds, and monitoring for advisory lock contention, skipped scheduler runs, and worker exhaustion.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Missing authorization checks in the Red Hat Ansible Automation Platform 2 automation-controller allow an authenticated o
Authenticated users who hold permission to create or modify a project within a single organization can execute arbitrary
Privilege escalation and remote code execution on managed hosts is possible in Red Hat Ansible Automation Platform 2 bec
Credential disclosure in Red Hat Ansible Automation Platform 2.5 and 2.6 allows any authenticated user to retrieve plain
Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin
Privilege escalation in Red Hat Ansible Automation Platform 2 (built on the AWX upstream project) lets an authenticated
Arbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended
Symlink-following file overwrite on the Ansible control node is possible in ansible-core when a user runs `ansible-galax
Stored cross-site scripting in the automation-controller component of Red Hat Ansible Automation Platform 2 lets an auth
An authenticated automation-controller administrator in Red Hat Ansible Automation Platform 2 can turn the administrator
Jinja2 template injection in Ansible Operator Plugins (CWE-1336) lets an authenticated Kubernetes user who can create or
Missing object-level authorization in the JobTemplate copy endpoint (CopyAPIView) of AWX and Red Hat Ansible Automation
Exploit-DB