CVE-2026-84712 in Ansible Automation Platform
Summary
by MITRE • 09/23/2026
A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory (node hostnames, node types, UUIDs, heartbeats, capacities, and exact versions), all instance-group names and membership, the deployment install UUID, and the active control node. A remote, unauthenticated attacker can use this to map the control plane and fingerprint software versions for targeted attacks. This flaw affects confidentiality only; it does not expose secrets, credentials, or tenant data.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in the automation-controller API represents a significant information disclosure risk stemming from improper access controls on an unauthenticated endpoint. Specifically, the health-check interface located at /api/v2/ping/ is configured with AllowAny permissions, which inadvertently allows anonymous users to query sensitive internal state data. This configuration error results in over-serialization of Role-Based Access Control gated automation-mesh information into responses intended for public verification purposes. The flaw effectively bypasses authentication requirements that should restrict such detailed infrastructure visibility to authorized administrators only, creating a direct pathway for remote attackers to gather critical intelligence about the target environment without needing valid credentials or prior access.
The technical nature of this flaw involves the exposure of comprehensive inventory data through an endpoint designed solely for connectivity checks. When accessed by an unauthenticated actor, the API returns a detailed snapshot of the automation mesh topology. This includes node hostnames and types, unique identifiers such as UUIDs, real-time heartbeat statuses, resource capacities, precise software version numbers, all instance-group names along with their membership lists, the deployment install UUID, and identification of the active control node. By aggregating these data points, an attacker can construct a complete map of the control plane architecture. This level of detail allows for deep fingerprinting of the underlying infrastructure components, revealing not just what software is running but how it is organized and which nodes are currently active or idle within the mesh network.
From an operational impact perspective, this vulnerability primarily affects confidentiality rather than integrity or availability. While no secrets, credentials, or tenant-specific data are directly exposed in this response, the information gained provides a powerful foundation for subsequent targeted attacks. Knowledge of exact software versions enables attackers to search for known vulnerabilities associated with those specific releases, facilitating version-exploitation strategies. The mapping of node hostnames and types allows adversaries to identify potential entry points or high-value targets within the infrastructure. Furthermore, understanding instance-group memberships helps in planning lateral movement strategies once initial access is achieved elsewhere. Although this flaw does not immediately compromise system integrity, it significantly lowers the barrier for reconnaissance activities that often precede more severe intrusions.
This vulnerability aligns with CWE-200, which categorizes information exposure as a class of weaknesses where sensitive information is disclosed to unauthorized actors. It also relates closely to ATT&CK technique T1592, Gather Victim Host Information, specifically the sub-technique for gathering host configuration data such as software versions and network configurations. The misuse of an unauthenticated endpoint mirrors patterns seen in CWE-862, Missing Authorization, where access control checks are either absent or incorrectly implemented on resources that require restricted visibility. Remediation efforts should focus strictly on restricting access to the /api/v2/ping/ endpoint so that it requires valid authentication and appropriate RBAC permissions before returning any data beyond basic connectivity status. Additionally, implementing strict output filtering to ensure that only non-sensitive health metrics are returned in anonymous responses would mitigate this risk while preserving the utility of the health-check functionality for legitimate monitoring systems.