CVE-2026-84712 Information disclosure in Red Hat Ansible Automation Platform 2.5 for RHEL 8
Unauthenticated attackers can access the ping endpoint to view internal topology, instance groups, and version details of the automation controller.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-84712?
CVE-2026-84712 is a medium-severity vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8, published on 23 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory (node hostnames, node types, UUIDs, heartbeats, capacities, and exact versions), all instance-group names and membership, the deployment install UUID, and the active control node. A remote, unauthenticated attacker can use this to map the control plane and fingerprint software versions for targeted attacks. This flaw affects confidentiality only; it does not expose secrets, credentials, or tenant data.
Weakness: CWE-497
Which versions are affected by CVE-2026-84712?
How do I fix CVE-2026-84712?
Apply the vendor's patch.
Is CVE-2026-84712 being exploited?
There is no known exploitation of CVE-2026-84712 in the wild and no public exploit code.
Sources
Also known as GHSA-cvm2-8wp9-2853.