Ansible Automation Platform EUVD-2026-85611

Requires: (1) controller System Administrator/superuser privileges to reach the instance install-bundle endpoint and register instances; (2) a deployment where hostname registration is exploitable via the case-sensitivity mismatch - the charset validator is case-insensitive while the uniqueness validator is case-sensitive, letting an attacker register a case variant of an existing control node's hostname; and (3) an on-path/man-in-the-middle network position on the receptor mesh to actually leverage the forged certificate for impersonation or interception. The impact is meaningfully realized primarily in managed/hosted deployments where the customer holds controller superuser but the platform operator runs the mesh, giving the customer-controlled attacker a mesh peer credential they should not be able to mint. Limiting factors: high privilege requirement (superuser), the additional on-path prerequisite, and the fact that receptor work submission is gated by a separate signing key not in the bundle, so this yields impersonation/interception but not direct code execution.

This is a genuine but conditional integrity/impersonation flaw, not a mass-exploitation priority. The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N = 6.6) is internally consistent with the description: PR:H reflects the required controller System Administrator/superuser role, AC:H reflects the two hard preconditions (registering a case-variant hostname AND establishing an on-path/man-in-the-middle position on the receptor mesh network), and S:C reflects that impersonating a mesh peer affects other systems (control/hybrid nodes) beyond the controller. C:H captures interception of intercepted control-plane traffic; I:L captures limited tampering; A:N is correct as no availability loss is described. No EPSS score, no CISA KEV listing, and no public POC are present in the intelligence, so this is no public exploit identified at time of analysis. The realistic risk is concentrated in the specific managed/hosted deployment model the vendor calls out (customer holds controller superuser while the platform operator runs the mesh) - outside that model, a superuser who already controls the mesh gains little new. The vendor explicitly notes this does NOT grant remote code execution because receptor work submission is gated by a separate signing key not included in the install bundle, so severity ceilings well below the impersonation-to-RCE assumption a defender might otherwise make. Net: a real, high-privilege, high-complexity flaw worth patching in multi-tenant/managed AAP but not an urgent internet-facing emergency.

In a managed AAP2 deployment, a customer's controller superuser registers a new instance whose hostname is a case variant (e.g. 'Node1' vs existing 'node1'), passing the case-insensitive charset validator while defeating the case-sensitive uniqueness check. They download that node's install bundle and receive a mesh-CA-signed X.509 certificate valid for ten years with no revocation path, whose CN/SAN/node-id match the legitimate control node under case-insensitive TLS comparison. With an on-path network position on the receptor mesh, they use this credential to impersonate or intercept that control node's TLS traffic. No public exploit code is identified at time of analysis.