# CVE-2026-84712: Red Hat Ansible Automation Controller API information disclosure

Source: https://junglewise.ai/threats/cve-2026-84712-a-flaw-was-found-in-the-automation-controller-api-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-84712 · Severity: medium · CVSS 5.3 · Published 2026-09-23

Red Hat Ansible Automation Controller is a platform for managing infrastructure automation across enterprises. An unauthenticated attacker can access a public health-check endpoint that leaks sensitive internal infrastructure details including node names, deployment topology, versions, and identifiers. This exposes the control plane structure and enables fingerprinting for targeted attacks against the automation infrastructure.

Technologies: [Red Hat Ansible Automation Platform](https://junglewise.ai/threats/technologies/ansible-automation-platform-2). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-84712 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84712 being exploited in the wild.

**How severe is CVE-2026-84712?** Medium severity, with a CVSS score of 5.3, published 23 September 2026.

**Which products and versions are affected?** Red Hat Ansible Automation Platform not specified.

**Is there a fix for CVE-2026-84712?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-84712 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-84712?** Check whether you run Red Hat Ansible Automation Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The /api/v2/ping/ endpoint in Ansible Automation Controller over-serializes RBAC-protected automation-mesh data in its unauthenticated response, disclosing full instance inventory (hostnames, node types, UUIDs, heartbeats, capacities, versions), instance-group names and membership, deployment install UUID, and active control node information. No authentication is required; the attack is a simple HTTP GET. The vulnerability exposes confidential infrastructure topology but not secrets or credentials.

## Affected products

- Red Hat Ansible Automation Platform not specified

## Timeline

- 2026-09-23: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://catalog.redhat.com/software/containers/](https://catalog.redhat.com/software/containers/)

## Related threats

- [AWX WebSocket consumer incorrect authorization](https://junglewise.ai/threats/cve-2026-71367-an-incorrect-authorization-vulnerability-was-found-in-awx-s)
- [Red Hat Ansible Automation Platform cleartext storage of resource-server secret](https://junglewise.ai/threats/cve-2026-126643-a-cleartext-storage-flaw-was-found-in-the-aap-gateway-operator)
- [Pulpcore expression language injection in content guard](https://junglewise.ai/threats/cve-2026-123084-an-expression-language-injection-has-been-found-in-the)
- [Red Hat Ansible Automation Platform stored XSS in Hub documentation renderer](https://junglewise.ai/threats/cve-2026-109131-the-hub-collection-module-documentation-renderer-in-the-unified)
- [Ansible Operator Jinja2 template injection](https://junglewise.ai/threats/cve-2026-92982-a-flaw-was-found-in-ansible-operator-plugins-a-low-privileged)