CVE-2026-84719 Red Hat CVE debrief

Who should care

System administrators and security teams responsible for Ansible Automation Platform and Red Hat Ansible Automation Platform 2.4 for RHEL 8 should assess exposure and prioritize remediation.

Why it matters

CVE-2026-84719 is a critical flaw in Ansible Automation Platform automation-controller that allows unauthorized use of instance groups, potentially leading to security and reliability impacts. System administrators and security teams should assess exposure and prioritize remediation.

• Potential for unauthorized automation execution in control-plane context
• Bypassing of InstanceGroup use_role boundary
• Elevation of privileges for users with workflow-admin roles
• Possible impact on automation reliability and security

Technical summary

The flaw in Ansible Automation Platform automation-controller occurs when a WorkflowJobTemplate is copied. The deep-copy permission sanitizer fails to check instance_groups, execution_environment, and labels, allowing a user with organization workflow-admin permission but no role on the referenced instance groups to copy a workflow, become its administrator, and launch jobs pinned to instance groups they are not authorized to use.

Defensive priority

High priority remediation is recommended for systems with untrusted users or where permissions are not tightly controlled.

Recommended defensive actions

• Review and restrict permissions for users with organization workflow-admin roles
• Verify instance group configurations and permissions
• Monitor for suspicious activity in automation-controller
• Apply Red Hat errata RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71115, RHSA-2026:71177, and RHSA-2026:71179
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the flaw and its potential impact. Red Hat has provided errata and security advisories related to this CVE. A user with organization workflow-admin permission but no role on the referenced instance groups can copy a workflow, become its administrator, and launch jobs pinned to instance groups they are not authorized to use. This could lead to attacker-influenced automation running in the control-plane execution context. System administrators and security teams should assess exposure and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.