Ansible Automation Platform CVE-2026-84717

Requires a reachable automation-controller instance where at least one Job Template or Workflow Job Template has a Bitbucket Data Center webhook configured - the oracle only distinguishes configured (HTTP 200) from unconfigured/nonexistent (HTTP 403) targets, so value depends on Bitbucket DC integration being in use. No authentication and no knowledge of the secret webhook_key are needed (PR:N), and no user interaction is required. The vulnerable path is the unauthenticated Bitbucket DC webhook receiver's handling of diagnostics:ping events, where HMAC signature verification is skipped after the template lookup. Limiting factors: the attacker must have network access to the webhook endpoint, and the disclosed information is limited to which template IDs are webhook-enabled - no secrets, code execution, or elevated access follow.

This is a genuine but low-priority information-disclosure/enumeration issue, not a high-impact flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 MEDIUM) is internally consistent with the description: an unauthenticated network attacker exploits an HTTP 200-vs-403 response discrepancy in the Bitbucket Data Center webhook receiver as an existence oracle, gaining only limited confidentiality (C:L) - which Job Template / Workflow Job Template IDs have a Bitbucket DC webhook configured - with no integrity, availability, or scope impact and no recovery of the secret webhook_key. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data is provided. The real-world ceiling is low: the attacker learns configuration metadata (which template IDs are webhook-enabled), not credentials or code execution. Note this is the ONLY unauthenticated (PR:N) member of the Red Hat AAP2 automation-controller vulnerability family reported in this batch, which slightly raises its practical reachability versus its authenticated siblings, but the payoff remains reconnaissance-grade. Missing data explicitly: no EPSS, no KEV, no POC, no fixed version, no independent advisory beyond the Red Hat CVE page and Bugzilla 2527210.

An unauthenticated attacker who can reach the automation-controller's Bitbucket DC webhook endpoint sends crafted diagnostics:ping webhook requests iterating over Job Template and Workflow Job Template IDs, without any valid webhook_key. Because HMAC signature verification is skipped for ping events after the template lookup, the endpoint returns HTTP 200 for IDs that have a Bitbucket DC webhook configured and HTTP 403 otherwise, letting the attacker map webhook-enabled templates. No public POC is identified, but the low attack complexity (AC:L) and lack of authentication (PR:N) make the enumeration trivial to script.