# CVE-2026-125063: Automation-controller: automation-controller: quadratic regex in schedule rrule validation allows an authenticated user to exhaust api web workers (denial of service)

Status: published. Published: 2026-11-09. Updated: 2026-11-09.

A flaw was found in the rrule validation of schedules in automation controller. Several non-anchored regular expressions with lazy wildcard prefixes are applied to the user-supplied rrule value; when the expected DTSTART/RRULE tokens are absent, validation time grows quadratically with the length of the value. An authenticated user can submit a large token-free rrule through the REST API, including the schedule preview endpoint, which requires no resource-level permissions; validation runs synchronously in the API web worker, so a single such request occupies a worker for an extended time and repeated requests can exhaust the web worker pool, denying access to the API and web UI while the attack is sustained. The impact is limited to availability.

## Remediation

- workaround: The schedule preview endpoint is available to any authenticated user and cannot be restricted by RBAC, so exposure can only be reduced by limiting API access to trusted users. (source: CNA: redhat)

## Affected products and versions

- Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-26/controller-rhel9): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-27/controller-rhel9): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Ansible Automation Platform 2 (automation-controller): Version range not reported. Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 4.3 (medium); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L; source: CNA: redhat

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-1333

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/security/cve/CVE-2026-125063 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2569200 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-125063; retrieved 2026-11-09; source updated 2026-11-09

Revision: a5a51c73e17d854f1160c4dd9678d006593ec64aa1ca96388e3be8dcd86a1027

Canonical: https://y2.dev/cve/CVE-2026-125063

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.