Is CVE-2026-84719 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84719 being exploited in the wild.

How severe is CVE-2026-84719?

Critical severity, with a CVSS score of 9.9, published 23 September 2026.

Is there a fix for CVE-2026-84719?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-84719 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-84719?

Check whether you run Red Hat Ansible Automation Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84719: Red Hat Ansible Automation Platform controller privilege escalation in WorkflowJobTemplate copy

CVE-2026-84719 · Severity: critical · CVSS 9.9 · Published 2026-09-23

Red Hat Ansible Automation Platform's automation-controller service allows organization admins to copy workflow templates, but fails to properly validate permissions on instance groups during the copy operation. An attacker with workflow-admin privileges but no access to certain instance groups can exploit this to become administrator of the copied workflow and execute automation on restricted instance groups, including the control plane, bypassing security boundaries intended to limit job execution context.

Technologies: Red Hat Ansible Automation Platform. Vendors: Red Hat.

Quick answers

Is CVE-2026-84719 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84719 being exploited in the wild.
How severe is CVE-2026-84719?: Critical severity, with a CVSS score of 9.9, published 23 September 2026.
Which products and versions are affected?: Red Hat Ansible Automation Platform <UNKNOWN>.
Is there a fix for CVE-2026-84719?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-84719 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-84719?: Check whether you run Red Hat Ansible Automation Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the WorkflowJobTemplate copy functionality, where the deep-copy permission sanitizer validates only inventory, unified_job_template, and credentials but fails to validate instance_groups, execution_environment, and labels inherited from the source template. An authenticated user with organization workflow-admin role but lacking use_role permissions on target instance groups can copy a workflow and escalate to full administrator of the copy, then execute jobs in unauthorized execution contexts including the control plane.

Affected products

Red Hat Ansible Automation Platform <UNKNOWN>

Timeline

2026-09-23: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.