CVE-2026-84719

CriticalCVSS 9.9/10Last modified Sep 25, 2026

Description

A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of each cloned node and fails to check the instance_groups (and execution_environment and labels) that were preserved from the original. A user with organization workflow-admin permission but no role on the referenced instance groups can copy a workflow, become its administrator, and launch jobs pinned to instance groups they are not authorized to use — including the control-plane instance group — bypassing the InstanceGroup use_role boundary and causing attacker-influenced automation to run in the control-plane execution context.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 23, 2026
Last modified: Sep 25, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-84724.3GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that CVE-2026-847206.5A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which sto CVE-2026-847216.4A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email CVE-2026-847246.6An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template CVE-2026-847275.4Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a malicious RTMP peer to crash CVE-2026-847319.8An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element b CVE-2026-847328.7Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via CVE-2026-847349.8The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own CVE-2026-847368.3In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables CVE-2026-847379.8The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthent CVE-2026-847389.1The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing us CVE-2026-847398.7GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 t