CVE-2026-84721 Red Hat CVE debrief

Who should care

Defenders and security teams responsible for Ansible Automation Platform automation-controller deployments, especially those with internal networks and services accessible to authenticated users, should assess potential exposure and impact.

Why it matters

CVE-2026-84721 is a server-side request forgery flaw in the Ansible Automation Platform automation-controller email notification backend. Authenticated users with organization notification-admin permissions can create or modify email notification templates to point to internal addresses, potentially exposing internal services and allowing for port scanning. Defenders should prioritize verifying exposure, assessing potential impact, and implementing additional validation for SMTP host and port inputs.

• Potential internal port scanning using the email notification backend.
• Possible exposure of internal services to authenticated users.
• Risk of credential transmission to attacker-controlled servers if SMTP passwords are stored.

Technical summary

The email backend passes the user-supplied SMTP host and port from a notification template directly to the SMTP client without validating that the target is not an internal, loopback, link-local, or reserved address. An authenticated user with organization notification-admin permission can create or modify an email notification template pointing at an arbitrary internal address, trigger a test, and have the controller task process open a raw TCP connection to that address.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, especially in environments where internal networks and services may be accessible to authenticated users with organization notification-admin permissions.

Recommended defensive actions

• Verify the Ansible Automation Platform automation-controller version and check if it is vulnerable.
• Restrict permissions for organization notification-admin users.
• Implement additional validation for SMTP host and port inputs in notification templates.
• Monitor for suspicious activity related to email notification templates and SMTP connections.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the server-side request forgery flaw in the Ansible Automation Platform automation-controller email notification backend. However, the corpus does not establish versions, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.