unauthenticated health-check endpoint /api/v2/ping/
(ApiV2PingView, AllowAny) over-serializes RBAC-gated
automation-mesh data into its anonymous response, exposing the
full instance inventory (node hostnames, node types, UUIDs,
heartbeats, capacities, and exact versions), all instance-group
names and membership, the deployment install UUID, and the
active control node. A remote, unauthenticated attacker can use
this to map the control plane and fingerprint software versions
for targeted attacks. This flaw affects confidentiality only;
it does not expose secrets, credentials, or tenant data.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 | affected | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | affected | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | affected | — |
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 23 Sep 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory (node hostnames, node types, UUIDs, heartbeats, capacities, and exact versions), all instance-group names and membership, the deployment install UUID, and the active control node. A remote, unauthenticated attacker can use this to map the control plane and fingerprint software versions for targeted attacks. This flaw affects confidentiality only; it does not expose secrets, credentials, or tenant data. | |
| Title | Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership | |
| First Time appeared |
Redhat
Redhat ansible Automation Platform |
|
| Weaknesses | CWE-497 | |
| CPEs | cpe:/a:redhat:ansible_automation_platform:2 | |
| Vendors & Products |
Redhat
Redhat ansible Automation Platform |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2026-09-23T19:40:22.582Z
Reserved: 2026-09-02T00:44:46.968Z
Link: CVE-2026-84712
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-23T20:17:17.817
Modified: 2026-09-23T20:17:17.817
Link: CVE-2026-84712
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-09-23T20:30:09Z