Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust
Summary
| CVE | CVE-2026-84718 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-23 20:17:18 UTC |
| Updated | 2026-11-06 01:17:58 UTC |
| Description | A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost (attacker-controlled) header value. As a result, an attacker can forge the source IP address recorded for their requests in the Controller's audit and access logs, degrading the integrity of forensic and SIEM attribution. The flaw does not grant additional access. |
Risk And Classification
Primary CVSS: v3.1 4.3 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS: 0.001360000 probability, percentile 0.030560000 (date 2026-11-06)
Problem Types: CWE-348 | CWE-348 Use of Less Trusted Source
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 4.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| 3.1 | CNA | CVSS | 4.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Ansible Automation Platform 2.5 For RHEL 8 | unaffected 0:4.6.33-1.el8ap * rpm | Not specified |
| CNA | Red Hat | Red Hat Ansible Automation Platform 2.5 For RHEL 8 | unaffected 0:4.6.33-1.el8ap * rpm | Not specified |
| CNA | Red Hat | Red Hat Ansible Automation Platform 2.5 For RHEL 9 | unaffected 0:4.6.33-1.el9ap * rpm | Not specified |
| CNA | Red Hat | Red Hat Ansible Automation Platform 2.5 For RHEL 9 | unaffected 0:4.6.33-1.el9ap * rpm | Not specified |
| CNA | Red Hat | Red Hat Ansible Automation Platform 2.6 For RHEL 9 | unaffected 0:4.7.17-1.el9ap * rpm | Not specified |
| CNA | Red Hat | Red Hat Ansible Automation Platform 2.6 For RHEL 9 | unaffected 0:4.7.17-1.el9ap * rpm | Not specified |
| CNA | Red Hat | Red Hat Ansible Automation Platform 2.6 | unaffected 1789673739 * rpm | Not specified |
| CNA | Red Hat | Red Hat Ansible Automation Platform 2.7 | unaffected 1789580684 * rpm | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:71113 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:71179 | [email protected] | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-84718 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:71177 | [email protected] | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | [email protected] | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:71114 | [email protected] | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-09-02T01:18:40.552Z | Reported to Red Hat. |
| CNA | 2026-09-23T00:00:00.000Z | Made public. |
Workarounds
CNA: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Note that merely populating PROXY_IP_ALLOWED_LIST does not fully resolve the issue in the shipped Envoy-fronted deployment, because the leftmost (attacker-controlled) X-Forwarded-For entry is still selected as the client IP, and the trusted-proxy shared-secret mechanism (a valid HTTP_X_TRUSTED_PROXY header), which makes Controller prefer the trusted rightmost X-Forwarded-For entry, is not enabled by default. Updated automation-controller packages that address this flaw are available for the Ansible Automation Platform 2.5, 2.6, and 2.7 update streams; the Ansible Automation Platform 2.4 stream will not receive a fix for this issue.