Log in / Sign up

Vulnerability details

CVE-2026-84486

Automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (allowany, routed without debug guard) allow advisory-lock starvation of job dispatch (dos)

CVSS 3.1
8.2High

Official description

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views that trigger the internal task, dependency, and workflow schedulers are configured to allow any user (including unauthenticated clients) and are routed in production builds because their URL include is not gated on the debug setting. An unauthenticated remote attacker can repeatedly invoke these endpoints to acquire the cluster-wide scheduler advisory lock; because the legitimate scheduler acquires the same lock without waiting, the attacker causes real scheduler runs to be skipped, stalling job dispatch for all tenants, while also consuming controller web workers. The debug root view additionally discloses the list of debug endpoints to unauthenticated callers.

CVSS scores

ScoreVersionSourceVector
8.2High 3.1 CVEProject cvelistV5 (CNA) (redhat) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Affected products

VendorProductVersionsSource
No product information recorded.

References and advisories

5
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-09-23
Last updated
2026-11-05
State
Published
Assigner (CNA)
redhat

Exploit prediction (EPSS)

0.65%
Probability of exploitation in 30 days
51.5%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
Yes
Exploitation
None
Technical impact
Partial

Weaknesses (CWE)

  • CWE-489
    Active Debug Code