Ansible automation-controller: provisioning-callback secret leaks to read-only users and X-Forwarded-For is trusted

Impact

automation-controller exposes a job template's host_config_key provisioning secret to anyone holding only view_jobtemplate, both in the API representation and in the activity stream. The provisioning callback endpoint then decides which host is calling from a client-supplied X-Forwarded-For header, which is attacker-controlled when the controller sits behind the AAP gateway with an empty proxy allow-list. A minimally privileged (or, in that gateway configuration, unauthenticated) remote attacker can therefore launch an existing job template against any host in its inventory using the template's own credentials. On a fleet where AAP drives node provisioning, firmware rollout or GPU driver installs, that is remote code execution on managed GPU nodes with whatever privilege the automation credential carries, scored 9.9 with a changed scope.

Who can reach it

Network access to the automation-controller API with a low-privileged account that can view a job template; unauthenticated when the controller is behind the AAP gateway with an empty proxy allow-list.

What to do

Apply the Red Hat errata for your AAP release (RHSA-2026:71113/71114/71115/71177/71179 cover 2.4 through 2.7) and restart the automation-controller services; no node reboot is required. Until patched, rotate host_config_key on every job template, disable provisioning callbacks where they are not needed, and populate the gateway proxy allow-list so X-Forwarded-For is not taken from clients.

References

Related entries

• Ansible automation-controller: project SCM URL starting with a dash becomes a git --upload-pack command executionCVE-2026-84502 · Red Hat Ansible Automation Platform automation-controller (Project scm_url to git ls-remote)Critical
• Ansible automation-controller: copied workflows keep instance groups, letting a tenant run jobs on the control planeCVE-2026-84719 · Red Hat Ansible Automation Platform automation-controller (workflow deep-copy permission sanitizer)Critical
• GitLab EE: Duo Chat GraphQL subscription leaks Advanced Search config and credentialsCVE-2026-87719 · GitLab EE (Duo Chat GraphQL subscription argument handling)Critical
• GitLab CE/EE: double free parsing a crafted CI/CD regular expression gives code execution on the serverCVE-2026-89078 · GitLab CE/EE (CI/CD config regular-expression parser)Critical
• GitLab CE/EE: integer overflow compiling a crafted CI/CD regular expression gives code execution on the serverCVE-2026-93577 · GitLab CE/EE (CI/CD config regular-expression compiler)Critical
• lldpd (lldp_decode, management addresses): Buffer overflow in lldpd's LLDP decoder via large management addressesCVE-2015-8011 · lldpd (lldp_decode, management addresses)Critical