EUVD-2026-85867
GHSA-ch6h-xwwm-655w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as gateway admin
-
DeliveryCreate unrestricted Controller service key
-
ExploitForge Controller service-auth token
-
ExecutionDrive OIDC endpoint to sign forged WIT
-
PersistPresent WIT to trusting Vault
-
ImpactRetrieve secrets beyond authorization boundary
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated gateway administrator account on Red Hat Ansible Automation Platform 2 (PR:H - not unauthenticated). Beyond admin access, exploitation depends on non-default configuration: the gateway OIDC workload-identity endpoint must be enabled via FEATURE_OIDC_WORKLOAD_IDENTITY_ENABLED, and a downstream resource server (such as HashiCorp Vault) must be configured to trust the gateway OIDC signing key. Deployments without OIDC workload identity enabled, or without a downstream server honoring gateway-issued WITs, are not exploitable for the full secret-disclosure chain. The core defect is that service-key creation was not restricted to the installer-provisioned path, letting an admin-issued key forge indistinguishable service tokens. |
| Impact | This is a genuine but access-gated confidentiality risk rather than a broadly-exploitable emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N = 6.8 MEDIUM) is internally consistent with the description: exploitation requires an already-authenticated administrator (PR:H), the attack is network-reachable with low complexity, and the scope change (S:C) plus high confidentiality (C:H) reflect that the forged token pivots from the AAP gateway to a downstream, separately-trusted resource server (e.g. HashiCorp Vault) to disclose secrets outside the attacker's authorization boundary. No EPSS score, KEV listing, or public POC is present in the input, so exploitation is theoretical/vendor-identified only. The dominant limiting factors are that the attacker must already hold gateway admin privileges AND the environment must have the non-default OIDC workload-identity feature (FEATURE_OIDC_WORKLOAD_IDENTITY_ENABLED) enabled AND a downstream server configured to trust the gateway OIDC key. This is a privilege-boundary/lateral-movement issue (an admin exceeding their intended secret-access scope), not an unauthenticated RCE - real priority for regulated/Vault-integrated AAP deployments, low urgency elsewhere. |
| Exploit ScenarioDerived | An authenticated AAP gateway administrator (or an attacker who has compromised such an account) calls the gateway API to create a new service key for the Controller service cluster; because key creation was not restricted to the installer provisioning path, this key is cryptographically indistinguishable from a legitimate one. The attacker uses it to forge a Controller service-authentication token and drives the OIDC workload-identity endpoint to sign Workload Identity Tokens for arbitrary Controller workloads, which a trusting HashiCorp Vault then honors, returning bound AAP credentials. No public exploit code is identified at time of analysis; the fix is confirmed via Red Hat/Ansible pull requests. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Ansible Automation Platform 2's gateway permits an authenticated gateway administrator (CVSS PR:H) to create a new service key for the Controller service cluster through the API, even though service-key creation is supposed to occur only via the installer-provisioned path; the resulting key is cryptographically indistinguishable from a legitimate one, so it can be used to mint a service-authentication token that impersonates the Controller service. When the non-default gateway OIDC workload-identity endpoint is enabled (FEATURE_OIDC_WORKLOAD_IDENTITY_ENABLED) and a downstream resource server such as HashiCorp Vault trusts the gateway's OIDC signing key, the attacker can induce the gateway to sign Workload Identity Tokens for arbitrary Controller workloads and retrieve the AAP credentials bound to that workload, crossing the administrator's authorization boundary to disclose secrets (C:H, no integrity or availability impact). Exploitation requires admin privileges plus that specific non-default trust configuration, and no public exploit has been identified at time of analysis; the defect is access-gated rather than broadly exploitable.
RemediationAI
The upstream fix is delivered through https://github.com/ansible/ansible.platform/pull/254 (restricting the service_key module to existing keys and failing when a key is missing, per AAP-65516) and https://github.com/ansible/jewel/pull/235 (which extracts ServiceKeyManager, moves the ServiceKey model, makes the algorithm and service_cluster fields non-editable so a key cannot be re-pointed to another service cluster or silently disabled, and removes the permissive serializer), so apply the corresponding AAP gateway update - upstream fix available (PR/commit); released patched version not independently confirmed - and track the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-94416 and https://bugzilla.redhat.com/show_bug.cgi?id=2537465 for the exact patched AAP 2 build number to install. Because service-key creation must only occur through installer provisioning, audit existing service keys in the gateway and delete or rotate any that were not created by the installer - note that rotation does not distinguish forged from legitimate keys by design, so revocation and reissuance is the only safe cleanup, and it will invalidate any legitimate token signed by a rotated key until the Controller service re-authenticates. As compensating controls where patching is delayed: disable the gateway OIDC workload-identity endpoint by unsetting FEATURE_OIDC_WORKLOAD_IDENTITY_ENABLED (this breaks all legitimate WIT-based workload authentication to Vault and similar resource servers), and/or stop downstream resource servers from trusting the gateway's OIDC signing key by removing that trust configuration in HashiCorp Vault (removing trust blocks the secret-disclosure chain but also disables legitimate workload-identity access). Tighten gateway administrator membership, since exploitation requires an authenticated admin (PR:H), and monitor gateway audit logs for unexpected POSTs to the service_keys API or unexpected WIT issuance for Controller workloads.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an authentication bypass by spoofing (CWE-290) rooted in the AAP gateway's service-key model and REST API. The gateway uses HMAC-signed JWTs (HS256/HS384/HS512) - the ServiceKey model exposes an algorithm choice and a manager-generated random secret - to authenticate internal service-to-service calls, and originally the ServiceKeySerializer accepted creation requests including writable fields such as service_cluster, is_active, algorithm, secret_length and mark_previous_inactive. Because key creation was not constrained to the installer-provisioned path, any authenticated gateway administrator could POST a new key for the Controller service cluster; since the manager generates the secret with the same secrets.token_urlsafe(64) routine used during installation, a forged key is indistinguishable from a legitimate one at verification time. The second half of the chain is the gateway's OIDC workload-identity endpoint, which - when FEATURE_OIDC_WORKLOAD_IDENTITY_ENABLED is set - signs Workload Identity Tokens for Controller workloads; a downstream resource server (the CPEs cover Red Hat Ansible Automation Platform 2 components, and the tags explicitly call out HashiCorp) that trusts the gateway OIDC key will honor such a WIT and release the credentials bound to the impersonated workload. The upstream fix (PR ansible/jewel#235) moves ServiceKey into a dedicated module, extracts ServiceKeyManager, adds Django migrations 0027 that mark algorithm and service_cluster editable=False so users cannot change the algorithm and effectively disable a key or re-point a key to a different service cluster, and deletes the old service_auth serializer; a companion change (PR ansible/ansible.platform#254) restricts the service_key module to editing existing keys only and fails instead of creating a missing key (AAP-65516), adding a seed-service-key-fixture target purely to keep integration tests working under edit-only semantics.
Know when Ansible gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Network API reachable with low complexity but requires gateway admin (PR:H); forged token crosses into a downstream trusting system (S:C) to disclose secrets (C:H), with no integrity or availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
An authorization bypass was found in the Ansible Automation Platform (AAP) gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. Because service-key creation is not restricted to the installer-provisioned provisioning path, an administrator-issued key is cryptographically indistinguishable from a legitimate one and can be used to forge a service-authentication token that impersonates the Controller service. Combined with the gateway OIDC workload-identity endpoint (enabled via FEATURE_OIDC_WORKLOAD_IDENTITY_ENABLED), the attacker can drive the gateway to sign Workload Identity Tokens (WITs) for arbitrary Controller workloads. A downstream resource server such as HashiCorp Vault that trusts the gateway OIDC key will accept the forged WIT and return the AAP credentials bound to that workload, disclosing secrets beyond the attacker's authorization boundary.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
Ansible Tower (aka Ansible UI) before 2.0.5 allows remote attackers to bypass authentication and obtain sensitive inform
Ansible Tower (aka Ansible UI) before 2.0.5 allows remote organization administrators to gain privileges by creating a s
Multiple cross-site scripting (XSS) vulnerabilities in Ansible Tower (aka Ansible UI) before 2.0.5 allow remote attacker
A flaw was found in ansible 2.8.0 before 2.8.4. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploit
A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkin
Confluent Ansible (cp-ansible) version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its a
A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a play
The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands. Rated high seve
Symlink-following file overwrite on the Ansible control node is possible in ansible-core when a user runs `ansible-galax
A flaw was found in the Ansible Engine when the fetch module is used. Rated medium severity (CVSS 4.6), this vulnerabili
Remote code execution via unsafe Python pickle deserialization in the community.general Ansible collection's memcached f
The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environme
Exploit-DB