Ansible automation-controller: unauthenticated debug endpoints grab the scheduler lock and stall job dispatch

Impact

Four debug views that kick the internal task, dependency and workflow schedulers are routed in production builds and configured to allow any caller, including unauthenticated ones, because their URL include is not gated on the debug setting. Hitting them repeatedly takes the cluster-wide scheduler advisory lock; the real scheduler takes the same lock without waiting, so its runs are simply skipped and job dispatch stalls for every tenant while controller web workers are consumed. Where automation-controller drives fleet operations - node provisioning, driver and firmware rollouts, drain and reboot playbooks - a stalled dispatcher means maintenance and remediation jobs silently never start. The debug root view also lists the debug endpoints to unauthenticated callers, so no guesswork is needed.

Who can reach it

Anyone who can reach the automation-controller web endpoint over the network. No authentication and no user interaction required.

What to do

Apply the Red Hat errata for your release (RHSA-2026:71113 / 71177 / 71179 for Ansible Automation Platform 2.6 and 2.7) and restart the controller services. Until patched, block the debug URL paths at the ingress or load balancer and make sure the controller is not reachable from untrusted networks. Service restart only - no node maintenance.

References

Related entries

• Ceph RGW (SigV4 signature verifier): Anyone handed a single presigned PUT URL gets more authority than whoever signedNCVD-2026-039-ceph-rgw-sigv4-signature-verifie · Ceph RGW (SigV4 signature verifier)High
• Ceph MON (config-key store, MMonSubscribe handler): MULTI-TENANT ISOLATION AND HOST COMPROMISE: one craftedNCVD-2026-041-ceph-mon-config-key-store-mmonsu · Ceph MON (config-key store, MMonSubscribe handler)High
• Ceph MON (ceph-mon): The monitor accepts pool create/delete and snapshot operations from any authenticated user thatCVE-2018-10861 · Ceph MON (ceph-mon)High
• GlusterFS (brick, gfs3_mknod_req): A crafted mknod RPC traverses out of the volume and writes a file anywhere the brickCVE-2018-10926 · GlusterFS (brick, gfs3_mknod_req)High
• Cisco IOS XE MACsec Key Agreement (MKA over EAP-TLS): A logic error in MKA over EAP-TLS lets an unauthenticatedCVE-2018-15372 · Cisco IOS XE MACsec Key Agreement (MKA over EAP-TLS)High
• PostgreSQL: With cert/trust+clientcert auth, a MITM can inject arbitrary SQL at connection setupCVE-2021-23214 · PostgreSQLHigh