Ansible Automation Platform CVE-2026-84718

Exploitation requires the shipped/default production reverse-proxy configuration of automation-controller, in which the application trusts the client-supplied X-Forwarded-For header and selects the leftmost value without validating that the connection originated from a trusted proxy. The attacker must be able to send HTTP requests to the Controller whose activity is recorded in its audit/access logs (PR:L). Limiting factors: the impact is confined to integrity of logged source-IP attribution (I:L) with no confidentiality or availability effect and no gain of access; deployments that have overridden the header-trust configuration to only honor XFF from known proxies, or that record the true socket peer IP, are not affected.

This is a genuinely low-priority, low-real-risk issue despite the MEDIUM label. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, score 4.3, Red Hat self-reported) is internally consistent with the CWE-348 (Use of a Less Trusted Source) description: the sole impact is I:L (integrity of log attribution), with C:N and A:N, and the description explicitly states 'The flaw does not grant additional access.' No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation is neither confirmed nor probabilistically ranked - the SSVC/EPSS signals are simply absent rather than conflicting. PR:L is appropriate because forging X-Forwarded-For to pollute the audit trail is only meaningful in the context of an actor already interacting with the Controller whose actions are being logged; the real-world value is forensic evasion/misdirection, not access gain. Net: this is a defense-in-depth/log-integrity hardening item, not an emergency-patch situation. One note for verification: the CVSS vector marks S:U, which is reasonable since only the Controller's own logs are affected, but organizations that forward these logs into a shared SIEM should recognize the downstream analytical impact even though CVSS does not treat it as a scope change.

An attacker who can reach the automation-controller web API (and, per PR:L, has some level of access whose requests are being logged) adds a spoofed X-Forwarded-For header such as 'X-Forwarded-For: 10.0.0.5' to their requests; because the shipped production config trusts the leftmost, client-supplied value without validating it came from a trusted proxy, the Controller records the forged IP in its audit and access logs. The attacker thereby attributes their activity to an innocent or non-existent host, frustrating incident response and SIEM correlation. No public POC is identified at time of analysis, and the technique confers no additional access.