CVE-2026-84717 in Ansible Automation Platform
Summary
by MITRE • 09/23/2026
A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target template, causing the endpoint to return HTTP 200 for a template that has a Bitbucket DC webhook configured and HTTP 403 otherwise. An unauthenticated remote attacker can use this response discrepancy as an oracle to enumerate which Job Template and Workflow Job Template IDs have Bitbucket DC webhooks configured, without knowing the secret webhook_key.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in Ansible Automation Platform's automation-controller component represents a significant information disclosure flaw rooted in inconsistent HTTP status code responses within the Bitbucket Data Center webhook receiver endpoint. This specific security issue arises from an unauthenticated entry point that processes diagnostics:ping events, where the application logic fails to uniformly enforce cryptographic signature verification across all execution paths. Specifically, when the system receives a ping event for a target template configured with a Bitbucket DC webhook, it successfully looks up the associated Job Template or Workflow Job Template and returns an HTTP 200 OK status code. Conversely, if no such configuration exists for the requested identifier, the endpoint responds with an HTTP 403 Forbidden status code. This discrepancy creates a side-channel that allows external actors to infer internal system state without possessing valid authentication credentials or webhook secrets.
From a technical perspective, this flaw constitutes a classic example of enumeration via response analysis, often categorized under CWE-209: Generation of Error Message Containing Sensitive Information and CWE-1346: Inconsistent Interpretation of HTTP Requests. The root cause lies in the conditional logic governing the webhook receiver's validation routine. While the system is designed to verify HMAC signatures for security purposes, the diagnostic ping handling path bypasses this check or handles it differently depending on whether the target resource exists and has specific configurations attached. By sending crafted requests with varying template IDs, an attacker can systematically probe the API endpoint. The binary nature of the response—either a success indicator (200) indicating presence and configuration, or a rejection (403) indicating absence or lack of webhook setup—provides a reliable oracle for mapping internal identifiers.
The operational impact of this vulnerability is primarily focused on reconnaissance and information gathering rather than immediate remote code execution. An unauthenticated remote attacker can leverage this behavior to enumerate valid Job Template IDs and Workflow Job Template IDs within the Ansible Automation Platform environment. This enumeration capability significantly reduces the attack surface required for subsequent exploitation phases, as it reveals which automation workflows are active and integrated with external version control systems like Bitbucket Data Center. Knowledge of these identifiers allows an attacker to tailor further attacks against specific templates or attempt to exploit other potential weaknesses in those identified components. Although the vulnerability itself does not directly compromise confidentiality of data or integrity of execution at this stage, it facilitates targeted attacks by exposing structural details of the automation infrastructure that should remain opaque to unauthenticated users.
Mitigation strategies for this issue require both immediate remediation and long-term architectural improvements. The primary fix involves ensuring that all webhook receiver endpoints, including those handling diagnostic ping events, consistently enforce HMAC signature verification regardless of whether the target template exists or has specific configurations enabled. This ensures that unauthorized requests are rejected uniformly with a generic error response, such as HTTP 401 Unauthorized or 403 Forbidden, without leaking information about resource existence. Additionally, implementing rate limiting on webhook endpoints can mitigate brute-force enumeration attempts by restricting the number of requests an IP address can make within a given timeframe. Organizations should also review their exposure of internal API endpoints to untrusted networks and ensure that diagnostic interfaces are not accessible from external zones unless strictly necessary for operational support.
In terms of industry standards, this vulnerability aligns with MITRE ATT&CK technique T1087: Account Discovery, specifically the sub-technique related to local account enumeration via network services, although applied here to internal automation identifiers rather than user accounts. It also relates to T1592: Gather Victim Host Information, where attackers collect details about connected systems and configurations. Addressing this flaw is critical for maintaining the principle of least privilege and minimizing information leakage in automated deployment pipelines. Security teams should prioritize patching the automation-controller component to a version that resolves this inconsistency and conduct audits to ensure no other endpoints exhibit similar response-based enumeration vulnerabilities. Regular penetration testing focusing on API endpoint behavior can help identify such discrepancies before they are exploited by malicious actors seeking to map out an organization's DevOps infrastructure.