PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-84716 Red Hat CVE debrief

A flaw in the automation-controller instance install-bundle endpoint allows for the issuance of 10-year, non-revocable receptor mesh-ca certificates with caller-chosen hostnames, potentially leading to TLS impersonation or interception in managed/hosted deployments. The vulnerability arises from the endpoint's use of caller-chosen hostnames for certificate issuance, which can be exploited through case-variant impersonation due to differences in hostname charset and uniqueness validation. This issue affects Red Hat Ansible Automation Platform deployments, particularly in managed/hosted environments.

Vendor
Red Hat
Product
Red Hat Ansible Automation Platform 2.5 for RHEL 8
CVSS
MEDIUM 6.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-23
Original CVE updated
2026-10-16
Advisory published
2026-09-23
Advisory updated
2026-10-16

Who should care

System administrators and security teams responsible for Red Hat Ansible Automation Platform deployments, especially in managed/hosted environments, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-84716 allows for non-revocable mesh-ca certificates with caller-chosen hostnames, potentially leading to TLS impersonation or interception in managed/hosted Red Hat Ansible Automation Platform deployments. System administrators and security teams should assess exposure and prioritize remediation.

  • Potential TLS impersonation or interception of control/hybrid mesh nodes in managed/hosted deployments.
  • Long-lived, non-revocable mesh peer credential issuance.
  • Need for verification of mesh-ca certificate validity and revocation procedures.

Technical summary

The automation-controller instance install-bundle endpoint issues 10-year, non-revocable receptor mesh-ca certificates with caller-chosen hostnames, allowing for potential TLS impersonation or interception in managed/hosted deployments. The certificates are signed with the receptor mesh certificate authority, using the Common Name, DNS subject-alternative-name, and receptor node-id taken verbatim from the caller-chosen instance hostname. This practice can lead to long-lived, non-revocable mesh peer credential issuance and potential TLS impersonation or interception of control/hybrid mesh nodes.

Defensive priority

System administrators and security teams should assess exposure and prioritize remediation for Red Hat Ansible Automation Platform deployments, especially in managed/hosted environments.

Recommended defensive actions

  • Review and update Red Hat Ansible Automation Platform deployments to ensure the latest version is used.
  • Assess exposure in managed/hosted environments and prioritize remediation.
  • Implement compensating controls, such as monitoring and exception tracking, to detect potential TLS impersonation or interception.
  • Verify the validity of mesh-ca certificates and ensure proper revocation procedures are in place.
  • Perform a thorough review of existing mesh-ca certificates for potential impersonation.
  • Conduct an inventory of systems that could be impacted and prioritize their remediation.
  • Establish a process for continuous monitoring of mesh-ca certificate usage.

Evidence notes

The CVE record and source item provide details on the vulnerability, while Red Hat errata and security advisories offer additional context and mitigation guidance. The vulnerability allows for non-revocable mesh-ca certificates with caller-chosen hostnames, potentially leading to TLS impersonation or interception in managed/hosted Red Hat Ansible Automation Platform deployments. System administrators and security teams should assess exposure and prioritize remediation. Evidence is limited to public CVE details and related vendor advis

Sources and references

Verified primary and authoritative sources

  • CVE-2026-84716 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-84716

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-84716 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-84716

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revoca

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84716.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/errata/RHSA-2026:71113

    Supplemental source - vendor-advisory, x_refsource_REDHAT

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/errata/RHSA-2026:71114

    Supplemental source - vendor-advisory, x_refsource_REDHAT

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/errata/RHSA-2026:71177

    Supplemental source - vendor-advisory, x_refsource_REDHAT

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/errata/RHSA-2026:71179

    Supplemental source - vendor-advisory, x_refsource_REDHAT

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/security/cve/CVE-2026-84716

    Supplemental source - vdb-entry, x_refsource_REDHAT

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.