# CVE-2026-84716: Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnames

Status: published. Published: 2026-09-23. Updated: 2026-11-06.

A flaw was found in the automation-controller instance
                  install-bundle endpoint. When a System Administrator downloads
                  an execution/hop node's install bundle, the controller signs an
                  X.509 certificate with the receptor mesh certificate authority
                  in which the Common Name, DNS subject-alternative-name, and
                  receptor node-id are taken verbatim from the caller-chosen
                  instance hostname, with a hard-coded ten-year validity, a random
                  serial, and no issuance log or revocation list. Because the
                  hostname charset validator is case-insensitive while the
                  uniqueness validator is case-sensitive, an administrator can
                  register a case variant of an existing control node's hostname
                  and obtain a mesh-CA-signed certificate that TLS peers, which
                  match hostnames case-insensitively, accept as that control node.
                  In managed/hosted deployments — where the customer holds
                  controller superuser but the platform operator runs the mesh —
                  this yields a long-lived, non-revocable mesh peer credential and,
                  with an on-path position, TLS impersonation or interception of
                  control/hybrid mesh nodes. It does not grant direct remote code
                  execution, because receptor work submission is gated by a
                  separate signing key not included in the bundle.

## Remediation

- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. (source: CNA: redhat)

## Affected products and versions

- Red Hat / Red Hat Ansible Automation Platform 2.5 for RHEL 8 (automation-controller): ≥ 0:4.6.33-1.el8ap; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Ansible Automation Platform 2.5 for RHEL 9 (automation-controller): ≥ 0:4.6.33-1.el9ap; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Ansible Automation Platform 2.6 for RHEL 9 (automation-controller): ≥ 0:4.7.17-1.el9ap; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Ansible Automation Platform 2.6 (ansible-automation-platform-26/controller-rhel9): ≥ 1789673739; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Ansible Automation Platform 2.7 (ansible-automation-platform-27/controller-rhel9): ≥ 1789580684; < * (unaffected, rpm). Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 6.6 (medium); CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N; source: CNA: redhat

- CISA KEV: No listing in collected sources

- EPSS: 0.18% as of 2026-11-05; percentile 7.46%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-266

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/errata/RHSA-2026:71113 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:71114 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:71177 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:71179 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/security/cve/CVE-2026-84716 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2527199 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-84716; retrieved 2026-11-06; source updated 2026-11-06

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-84716; retrieved 2026-11-06; source updated Not reported

Revision: 9d1362452b751472507707b9f68629c9709314e9d70ffab91d4bf149f6b8153e

Canonical: https://y2.dev/cve/CVE-2026-84716

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.