{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.6.33-1.el8ap","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.6.33-1.el9ap","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.7.17-1.el9ap","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","product":"Red Hat Ansible Automation Platform 2.6","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1789673739","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","product":"Red Hat Ansible Automation Platform 2.7","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1789580684","versionType":"rpm"}]}],"cveId":"CVE-2026-84712","cwes":["CWE-497"],"description":"A flaw was found in the automation-controller API. The\n                  unauthenticated health-check endpoint /api/v2/ping/\n                  (ApiV2PingView, AllowAny) over-serializes RBAC-gated\n                  automation-mesh data into its anonymous response, exposing the\n                  full instance inventory (node hostnames, node types, UUIDs,\n                  heartbeats, capacities, and exact versions), all instance-group\n                  names and membership, the deployment install UUID, and the\n                  active control node. A remote, unauthenticated attacker can use\n                  this to map the control plane and fingerprint software versions\n                  for targeted attacks. This flaw affects confidentiality only;\n                  it does not expose secrets, credentials, or tenant data.","epss":{"date":"2026-11-05","percentile":0.33038,"score":0.00388},"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1793927192460,"publishedAt":1790192422582,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:71113"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:71114"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:71177"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:71179"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-84712"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527196"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"There is no configuration option that trims the data returned by the unauthenticated /api/v2/ping/ endpoint (also reachable as /api/controller/v2/ping/). Exposure can be reduced by restricting network access to the automation-controller API so that only trusted networks and health probes can reach it: block or restrict external access to the /api/v2/ping/ and /api/controller/v2/ping/ routes at the reverse proxy, load balancer, or firewall, and front health checks with an infrastructure-level probe that does not proxy the /ping/ endpoint to untrusted clients. The definitive fix is to update to a version of automation-controller that no longer serializes instance, instance-group, install UUID, and active-node data in the unauthenticated response."}],"revision":"f38f392cbdeace5a7fac26076d172dfbf6770b3ea26ca49fbfec661ec6ddaa76","sources":[{"modifiedAt":1793927192460,"name":"CNA: redhat","retrievedAt":1793930975161,"url":"https://www.cve.org/CVERecord?id=CVE-2026-84712"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793931030405,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84712"}],"ssvc":{"assessedAt":1790260145289,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership","updatedAt":1793931030405}