{"id":"CVE-2026-84717","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-84717","generatedAt":"2026-10-28T10:37:03.415Z","title":"An unauthenticated remote attacker can use this response discrepancy as an oracle to enumerate which Job Template and Workflow Job Template IDs have Bitbucket DC webhooks configured, without knowing the secret webhook_key.","description":"A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated\nBitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping\nevents after it has already looked up the target template, causing the endpoint to return HTTP\n200 for a template that has a Bitbucket DC webhook configured and HTTP 403 otherwise. An\nunauthenticated remote attacker can use this response discrepancy as an oracle to enumerate\nwhich Job Template and Workflow Job Template IDs have Bitbucket DC webhooks configured, without\nknowing the secret webhook_key.","published":"2026-09-23T20:17:18.000Z","lastModified":"2026-09-26T23:16:38.000Z","status":"Awaiting Analysis","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.1","score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"cwe":["CWE-204"],"affected":[],"epss":{"score":0.00337,"percentile":0.26915,"date":"2026-10-27","history":[{"date":"2026-09-24","score":0.00337,"percentile":0.24283}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-09-23T20:17:18.000Z","detail":{"score":"5.3","severity":"MEDIUM","publishedAt":"2026-09-23T20:17:18.353Z"},"summary":"New CVE, medium severity (CVSS 5.3)."}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84717","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527210","source":"secalert@redhat.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-84717","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}