CVE-2026-84717

MediumCVSS 5.3/10Last modified Sep 26, 2026

Description

A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target template, causing the endpoint to return HTTP 200 for a template that has a Bitbucket DC webhook configured and HTTP 403 otherwise. An unauthenticated remote attacker can use this response discrepancy as an oracle to enumerate which Job Template and Workflow Job Template IDs have Bitbucket DC webhooks configured, without knowing the secret webhook_key.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-204

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 23, 2026
Last modified: Sep 26, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-847184.3A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts th CVE-2026-847199.9A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sa CVE-2026-84724.3GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that CVE-2026-847206.5A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which sto CVE-2026-847216.4A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email CVE-2026-847246.6An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template CVE-2026-847275.4Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a malicious RTMP peer to crash CVE-2026-847319.8An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element b CVE-2026-847328.7Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via CVE-2026-847349.8The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own CVE-2026-847368.3In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables CVE-2026-847379.8The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthent