# CVE-2026-84717: Red Hat Ansible Automation Platform automation-controller webhook signature verification bypass

Source: https://junglewise.ai/threats/cve-2026-84717-a-flaw-was-found-in-the-ansible-automation-platform-automation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-84717 · Severity: medium · CVSS 5.3 · Published 2026-09-23

A flaw in Red Hat Ansible Automation Platform's webhook receiver allows unauthenticated attackers to enumerate which job templates have Bitbucket webhooks configured. By sending specially crafted requests, an attacker can determine which templates are webhook-enabled based on the HTTP response code, potentially exposing infrastructure configuration without authentication. This information disclosure could facilitate targeted attacks against job automation workflows.

Technologies: [Red Hat Ansible Automation Platform](https://junglewise.ai/threats/technologies/ansible-automation-platform-2). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-84717 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84717 being exploited in the wild.

**How severe is CVE-2026-84717?** Medium severity, with a CVSS score of 5.3, published 23 September 2026.

**Which products and versions are affected?** Red Hat Ansible Automation Platform <UNKNOWN>.

**Is there a fix for CVE-2026-84717?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-84717 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-84717?** Check whether you run Red Hat Ansible Automation Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Bitbucket Data Center webhook receiver in automation-controller skips HMAC signature verification for diagnostics:ping events after resolving the target template, allowing response code differences (HTTP 200 vs 403) to leak template configuration. The vulnerability is unauthenticated and requires only network access to the webhook endpoint. An attacker can enumerate Job Template and Workflow Job Template IDs with active Bitbucket webhooks without knowledge of the webhook_key secret.

## Affected products

- Red Hat Ansible Automation Platform <UNKNOWN>

## Timeline

- 2026-09-23: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://catalog.redhat.com/software/containers/](https://catalog.redhat.com/software/containers/)

## Related threats

- [AWX WebSocket consumer incorrect authorization](https://junglewise.ai/threats/cve-2026-71367-an-incorrect-authorization-vulnerability-was-found-in-awx-s)
- [Red Hat Ansible Automation Platform cleartext storage of resource-server secret](https://junglewise.ai/threats/cve-2026-126643-a-cleartext-storage-flaw-was-found-in-the-aap-gateway-operator)
- [Pulpcore expression language injection in content guard](https://junglewise.ai/threats/cve-2026-123084-an-expression-language-injection-has-been-found-in-the)
- [Red Hat Ansible Automation Platform stored XSS in Hub documentation renderer](https://junglewise.ai/threats/cve-2026-109131-the-hub-collection-module-documentation-renderer-in-the-unified)
- [Ansible Operator Jinja2 template injection](https://junglewise.ai/threats/cve-2026-92982-a-flaw-was-found-in-ansible-operator-plugins-a-low-privileged)