{"id":"CVE-2026-84474","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-84474","generatedAt":"2026-10-28T03:58:48.726Z","title":"The provisioning-callback secret (host_config_key) is exposed to users holding only the read-level view_jobtemplate permission -- both in the job template API representation and in the activity stream -- and the provisioning callback endpoint trusts a…","description":"A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. The provisioning-callback secret (host_config_key) is exposed to\nusers holding only the read-level view_jobtemplate permission -- both in the\njob template API representation and in the activity stream -- and the\nprovisioning callback endpoint trusts a client-supplied X-Forwarded-For\nheader to determine the calling host when the controller is deployed behind\nthe AAP gateway with an empty proxy allow-list. By reading the secret and\nspoofing X-Forwarded-For to match any host in the job template's inventory, a\nminimally privileged or unauthenticated remote attacker can launch the job\ntemplate against arbitrary managed hosts using the job template's credentials,\nresulting in privilege escalation and remote code execution on managed hosts.","published":"2026-09-23T19:19:40.000Z","lastModified":"2026-09-24T06:17:02.000Z","status":"Awaiting Analysis","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.1","score":9.9,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"cwe":["CWE-807"],"affected":[],"epss":{"score":0.00801,"percentile":0.56409,"date":"2026-10-27","history":[{"date":"2026-09-24","score":0.00801,"percentile":0.54685}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.80%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-09-23T19:19:40.000Z","detail":{"score":"9.9","severity":"CRITICAL","publishedAt":"2026-09-23T19:19:39.930Z"},"summary":"New CVE, critical severity (CVSS 9.9)."}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71115","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84474","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527073","source":"secalert@redhat.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-84474","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}