Ansible Automation Platform CVE-2026-84721

Requires an authenticated user with organization notification-admin permission on the automation-controller - this is a privileged role, so it is not remotely reachable by anonymous users. The attacker must be able to create or modify an email notification template and trigger a test send. Exploitation depends on the controller's task network having reachable internal targets (loopback, link-local, reserved ranges, or the in-cluster Kubernetes API) - most impactful in the standard OpenShift/Kubernetes cluster deployment where the control-plane network hosts sensitive services. The credential-exfiltration escalation additionally requires that a shared organization email template already stores an SMTP password.

This is a moderate, credibly-real SSRF (CWE-918) but not an emergency. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N = 6.4) is internally consistent with the description: network-reachable, low complexity, but gated behind PR:L - the attacker must already hold organization notification-admin permission, a privileged role. The S:C (scope change) is justified because the SSRF pivots out of the application into the control-plane cluster network and the in-cluster Kubernetes API. No EPSS score, no CISA KEV listing, and no public POC were provided, so the exploitation signal is entirely theoretical: no public exploit identified at time of analysis. The primary impact is an information-only internal port-scan oracle (three-state: open/closed/filtered), which is reconnaissance rather than direct compromise - consistent with C:L/I:L/A:N. The secondary SMTP-credential-exfiltration path is more serious but conditional: it only fires when a shared organization template already stores an SMTP password, which the vendor evidently reflected by keeping C:L rather than C:H. Net: a genuine defense-in-depth issue for AAP operators, not a mass-exploitation priority. The main limiting factor is the privileged-role prerequisite; absent that, this is not reachable.

An authenticated user holding organization notification-admin permission in Ansible Automation Platform creates or edits an email notification template, sets the SMTP host/port to an internal target (e.g., the in-cluster Kubernetes API or a loopback/link-local service), and triggers a test send. The controller task process opens a raw TCP connection and reflects the connection result back through the notification record, giving an open/closed/filtered oracle for mapping control-plane services; if a shared template already stores an SMTP password, redirecting the host also leaks that credential to the attacker's server. No public POC is referenced.