CVE-2026-84470 Red Hat CVE debrief

Who should care

Defenders responsible for Ansible Automation Platform deployments, particularly those with multi-user environments or complex instance group configurations, should assess exposure and verify permissions.

Why it matters

CVE-2026-84470 allows unauthorized bulk job launches in Ansible Automation Platform, potentially bypassing execution-placement isolation. Defenders should verify instance group permissions, review job templates, and monitor for suspicious activity.

• Potential unauthorized bulk job launches on instance groups
• Bypassing of execution-placement isolation
• Need for verification of instance group permissions and job templates
• Possible lateral movement or privilege escalation

Technical summary

The Bulk Job Launch API in Ansible Automation Platform's automation-controller (AWX) performs a read-level permission check on instance groups, rather than the standard use-level permission check required for single-job launches. This allows a principal with read permission on an instance group and execute permission on a job template to launch bulk jobs onto instance groups they are not authorized to use.

Defensive priority

Defenders should prioritize verifying instance group permissions and reviewing job templates for potential misuse.

Recommended defensive actions

• Verify instance group permissions and job templates for potential misuse
• Review and restrict execute permissions on job templates
• Monitor for suspicious bulk job launches
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but its impact and affected versions require further verification from official sources. The Bulk Job Launch API in Ansible Automation Platform's automation-controller (AWX) performs a read-level permission check on instance groups, rather than the standard use-level permission check required for single-job launches. This allows a principal with read permission on an instance group and execute permission on a job template to launch bulk jobs onto instance groups they

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.