CVE-2026-94416 Red Hat CVE debrief

Who should care

Red Hat Ansible Automation Platform administrators and users, security teams, and DevOps teams responsible for automation and workload management, including those managing affected product deployments and verifying inventory, assessing exposure, and applying errata.

Why it matters

CVE-2026-94416 is a medium-severity authorization bypass vulnerability in the Red Hat Ansible Automation Platform gateway. Administrators should assess exposure, verify inventory, and apply errata to prevent potential disclosure of sensitive credentials and impersonation of the Controller service.

• Potential disclosure of sensitive credentials and secrets
• Impersonation of Controller service, bypassing authorization boundaries
• Compromised workload identity and authentication
• Verification of OIDC configuration and workload identity token protection

Technical summary

The Ansible Automation Platform gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. This can be used to forge a service-authentication token that impersonates the Controller service, potentially disclosing secrets beyond the attacker's authorization boundary. Affected product deployments include Red Hat Ansible Automation Platform 2.6 for RHEL 9, 2.7, and 2. The vulnerability allows an attacker to bypass authorization and impersonate the Controller service, which can lead to disclosure of sensitive credentials.

Defensive priority

Medium priority for Red Hat Ansible Automation Platform administrators to assess exposure and verify inventory.

Recommended defensive actions

• Assess exposure and verify inventory of Red Hat Ansible Automation Platform 2.6 for RHEL 9, 2.7, and 2
• Review and apply Red Hat errata and security advisories for affected versions
• Monitor for suspicious activity and implement compensating controls
• Verify workload identity token forgery protection and OIDC configuration
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the authorization bypass vulnerability in the Ansible Automation Platform gateway. Red Hat has provided errata and security advisories for affected versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.