CVE-2026-84721 in Ansible Automation Platform
Summary
by MITRE • 09/23/2026
A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend passes the user-supplied SMTP host and port from a notification template directly to the SMTP client without validating that the target is not an internal, loopback, link-local, or reserved address. An authenticated user with organization notification-admin permission can create or modify an email notification template pointing at an arbitrary internal address, trigger a test, and have the controller task process open a raw TCP connection to that address. The resulting connection error is reflected back through the notification record, providing a three-state internal port-scan oracle (open, closed, filtered) over the control-plane's cluster network, including the in-cluster Kubernetes API. When a shared organization template holds a stored SMTP password, redirecting the host can also cause that credential to be transmitted to an attacker-controlled server.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified as CVE-2024-3815 represents a critical Server-Side Request Forgery (SSRF) flaw within the email notification backend of Ansible Automation Platform, specifically affecting the automation-controller component. This security defect arises from insufficient input validation when processing SMTP configuration parameters provided by users through notification templates. The system accepts user-supplied SMTP host and port values without performing any checks to ensure that these targets are not internal, loopback, link-local, or reserved IP addresses. Consequently, an authenticated attacker possessing organization-level notification-admin permissions can manipulate the email backend to initiate connections to arbitrary destinations within the network infrastructure controlled by the victim organization. This lack of validation allows the controller task to open raw TCP connections to any address specified in the template configuration, bypassing standard security boundaries that typically restrict outbound traffic from management planes.
The operational impact of this vulnerability is severe due to its potential for both reconnaissance and credential theft. By triggering a test notification with a maliciously crafted SMTP host, an attacker can utilize the resulting connection errors returned through the notification record as an oracle. This mechanism effectively provides a three-state internal port-scanning capability, allowing the determination of whether ports are open, closed, or filtered on internal services. The scope of this scanning extends to critical infrastructure components within the cluster network, including the in-cluster Kubernetes API server. Such detailed network mapping can facilitate further attacks against other vulnerable services running on those internal addresses, significantly expanding the attack surface beyond the initial entry point.
In addition to network reconnaissance, the vulnerability poses a direct risk to credential confidentiality when shared organization templates are utilized. If an affected template contains stored SMTP credentials, such as usernames and passwords required for email delivery, redirecting the connection target allows these sensitive authentication details to be transmitted directly to an attacker-controlled server. This exfiltration occurs because the underlying SMTP client library attempts to authenticate with the specified host using the provided credentials before sending any actual notification data. Therefore, even if the initial scan does not reveal useful internal service information, the mere act of triggering a test can result in the leakage of high-value secrets that could compromise other systems relying on those same email accounts or API keys.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), as it enables an attacker to induce the server-side application to make requests to arbitrary destinations. Furthermore, the ability to scan internal ports and map network topology corresponds to ATT&CK technique T1046 Network Service Discovery, which adversaries use to identify services running on hosts for subsequent exploitation. The credential leakage aspect also relates to CWE-200 Information Exposure, where sensitive data is inadvertently disclosed through error responses or direct transmission to unauthorized endpoints. These classifications highlight the dual nature of the flaw as both a network mapping tool and an information disclosure vector.
Mitigation strategies must focus on implementing strict allow-listing for SMTP host configurations within the automation-controller. Administrators should configure the email backend to reject any connection attempts targeting private IP ranges, loopback addresses (127.0.0.0/8), link-local addresses (169.254.0.0/16), and other reserved address spaces defined in RFC 1918 and related standards. Additionally, the use of shared organization templates containing stored credentials should be restricted or eliminated to prevent credential exfiltration via SSRF vectors. If such templates are necessary, they must not store passwords that could be transmitted externally; instead, secure vaulting mechanisms with strict access controls should be employed. Regular auditing of notification template configurations and monitoring for unusual outbound connection patterns from the controller nodes can also help detect exploitation attempts early in the kill chain.