CVE-2026-84712

MediumCVSS 5.3/10Last modified Sep 24, 2026

Description

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory (node hostnames, node types, UUIDs, heartbeats, capacities, and exact versions), all instance-group names and membership, the deployment install UUID, and the active control node. A remote, unauthenticated attacker can use this to map the control plane and fingerprint software versions for targeted attacks. This flaw affects confidentiality only; it does not expose secrets, credentials, or tenant data.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-497

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 23, 2026
Last modified: Sep 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-847136.5A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ CVE-2026-847147.1A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular CVE-2026-847158.8FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allowing authenticated su CVE-2026-847166.6A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads CVE-2026-847175.3A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips CVE-2026-847184.3A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts th CVE-2026-847199.9A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sa CVE-2026-84724.3GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that CVE-2026-847206.5A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which sto CVE-2026-847216.4A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email CVE-2026-847246.6An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template CVE-2026-847275.4Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a malicious RTMP peer to crash