Executive brief
Ansible Automation Platform's job launch API has an authorization flaw that allows users with read-only permissions to execute jobs on instance groups they should not have access to. An attacker with read-level access to an instance group and execute permission on a job template can bypass isolation controls and run jobs in unauthorized environments, potentially compromising the integrity of automated deployments and job execution policies.
Technical details
The vulnerability is an authorization bypass in the Bulk Job Launch API endpoint (POST /api/v2/bulk/job_launch/) where instance_groups are checked only for read-level permissions instead of the required use-level permissions enforced by the standard single-job launch path. A principal with read (but not use) permission on an instance group—such as the built-in read-only System Auditor role—combined with execute permission on a job template can launch bulk jobs onto unauthorized instance groups. The flaw enables execution-placement isolation bypass, allowing attackers to circumvent intended access controls. No patch information is currently available in the advisory.
Affected products
- Red Hat Ansible Automation Platform <UNKNOWN>
Timeline
- 2026-09-01: disclosed