CVE-2026-84470

Executive Summary

CVE-2026-84470 is an authorization flaw in Red Hat Ansible Automation Platform's automation-controller component (AWX), specifically affecting the Bulk Job Launch API endpoint (POST /api/v2/bulk/job_launch/). The vulnerability allows a low-privileged principal holding read-level (but not use-level) permission on an instance group — such as the built-in read-only System Auditor role — combined with execute permission on a job template, to launch bulk jobs onto instance groups they are not authorized to use. This bypasses execution-placement isolation, enabling lateral movement of workloads into unintended compute environments. The CVSS score is 6.4 (Medium-High), with a network attack vector and low privilege requirement, yet the scope is "Changed" — meaning the compromise extends beyond the vulnerable component. No patch is currently available, and no public exploitation in the wild has been confirmed.

Technical Analysis

Vulnerability Class and Mechanism

The flaw is categorized under CWE-862 (Missing Authorization). The root cause is an inconsistent authorization model between two API paths within the AWX controller:

1. Standard single-job launch path — correctly enforces use-level permission checks on the instance_groups field.
2. Bulk Job Launch path (POST /api/v2/bulk/job_launch/) — only performs a read-level permission check on the requested instance_groups.

This inconsistency means that the authorization gate for the bulk endpoint is weaker than the standard path. In RBAC terms, permission levels are typically additive: read permission grants the ability to view an object's metadata, while use permission grants the right to execute operations consuming that object. The bulk launch API erroneously accepts read as a sufficient predicate for authorizing an instance group in a job launch context.

Attack Surface

The attack surface is the AWX REST API, accessible over the network. The vulnerable endpoint (POST /api/v2/bulk/job_launch/) is typically exposed to authenticated users of the Ansible Automation Platform. The attacker must have:

• Read permission on a target instance group (e.g., granted by the built-in System Auditor role).
• Execute permission on at least one job template.

No other high-privilege access is required. The attack is a privilege escalation via authorization bypass — the actor gains the capability to execute jobs on instance groups they were never granted use permission for.

Technical Detail Depth

The NVD description does not provide code-level specifics (function names, internal class names, or patch diffs). The vulnerability mechanism is described purely at the API-authorization level. The affected versions are not enumerated, and the vendor fix is not yet available. The underlying flaw can be reasoned at the framework level: the bulk-launch controller likely uses a different permission-checking decorator or helper function than the single-launch controller, and that helper verifies read rather than use on the instance_groups field — a classic copy-paste or oversight error in RBAC enforcement.

Exploitation Scenarios

No public PoC or exploit code is available. The attack chain below is inferred from the vulnerability class and the NVD description.

Step 1 — Reconnaissance and Target Identification

An authenticated attacker (with any low-privileged role such as System Auditor) identifies an AWX/automation-controller instance. They enumerate available job templates and instance groups via the standard API — for example, querying instance group objects to identify which ones they have read access to but not use access to. The attacker also identifies job templates for which they hold execute permission.

Step 2 — Triggering the Flaw

The attacker constructs a POST request to /api/v2/bulk/job_launch/. The request body includes:

• One or more job template IDs (for which the attacker has execute permission).
• One or more target instance_groups (for which the attacker holds only read permission).

The bulk-launch API validates the job template permissions (passes) and checks the instance group permissions using the weaker read check (also passes) — granting the request authorization.

Step 3 — Execution Method

The attacker submits the bulk job launch request. The AWX controller schedules the job templates onto the specified instance groups, executing playbooks on compute nodes the attacker was not authorized to use. Because this is a bulk launch, the attacker can simultaneously launch many jobs across multiple unauthorized instance groups, amplifying the impact.

Step 4 — Post-Exploitation Impact

Successful exploitation results in:

• Execution-placement isolation bypass: Jobs run on infrastructure the attacker was not permitted to use.
• Potential lateral movement: If instance groups map to distinct network segments or production environments, the attacker gains a foothold in those segments via job execution.
• Resource abuse: The attacker can consume compute resources on unauthorized nodes, potentially impacting operational workloads.
• Data exposure: Depending on job content, the attacker may access data accessible only from those instance groups.

The CVSS scope is "Changed" (C), meaning the compromised component (AWX API) allows impact on resources beyond its security scope — namely, the instance groups and their underlying hosts. Confidentiality impact is None (C:N), but Integrity (I:L) and Availability (A:L) are low-severity impacted.

Impact Assessment

Business Impact

• Configuration Management Integrity: Unauthorized job execution on restricted instance groups could alter system state on those nodes, degrading integrity of managed infrastructure.
• Compliance Violation: Organizations with strict environment segregation (e.g., PCI-DSS, production vs. staging) may violate compliance requirements if jobs execute in unauthorized environments.
• Operational Disruption: Unplanned jobs can consume resources, conflict with authorized workloads, or trigger unintended configuration changes, leading to availability degradation.

Affected Systems

• Red Hat Ansible Automation Platform deployments using the automation-controller (AWX) component.
• Any enterprise environment relying on instance-group-based execution isolation between environments or teams.

Blast Radius

• CVSS 6.4 / Medium-High severity. The attack vector is network (AV:N), requires low privileges (PR:L), no user interaction (UI:N), and scope is changed (S:C).
• The vulnerability is unpatched (patch confidence 0/4), meaning all current versions are potentially exposed.
• Not on CISA KEV — no confirmed exploitation in the wild.

Attacker Profile

• Privilege: Low-privileged authenticated user (e.g., System Auditor role).
• Skill level: Low-to-moderate — requires API manipulation but no custom tooling.

Detection Guidance

Sigma Rule

title: AWX Bulk Job Launch with Unauthorized Instance Group
id: 9b3f8a1c-7d2e-4f5a-9b4c-1d2e3f4a5b6c
status: experimental
description: Detects POST requests to AWX bulk job launch API where instance_groups are specified, indicating potential authorization bypass (CVE-2026-84470)
logsource:
  product: awx
  category: application
detection:
  selection:
    http.method: POST
    http.url|contains: '/api/v2/bulk/job_launch/'
    http.request.body|contains: 'instance_groups'
  condition: selection
falsepositives:
  - Legitimate bulk job launches by users with full 'use' permission on instance groups
  - Audit log entries generated by authorized administrator actions
level: medium
tags:
  - attack.tactic:execution
  - attack.technique:T1204
  - cve:CVE-2026-84470

YARA Rule

rule CVE_2026_84470_AWX_Bulk_Job_Launch_Unauthorized
{
    meta:
        author = "ValtersIT Threat Intel"
        description = "Detects exploit patterns for CVE-2026-84470 - AWX bulk job launch authorization bypass"
        date = "2026-04-01"
        cve = "CVE-2026-84470"
        severity = "medium"

    strings:
        $bulk_launch = "/api/v2/bulk/job_launch/" ascii wide nocase
        $instance_groups = "instance_groups" ascii wide nocase
        $job_template = "job_template" ascii wide nocase
        $launch = "launch" ascii wide nocase

    condition:
        // HTTP request targeting the bulk job launch endpoint
        $bulk_launch and $instance_groups and $job_template
        // Optional: presence of launch keyword to reduce false positives
        and $launch
}

Suricata IDS Rule

alert http any any -> $AWX_SERVERS any (
    msg:"CVE-2026-84470 - AWX Bulk Job Launch Authorization Bypass";
    flow:to_server,established;
    http.method;"POST";
    http.uri;content:"/api/v2/bulk/job_launch/";nocase;
    http.request_body;content:"instance_groups";file_data;nocase;
    reference:cve,CVE-2026-84470;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-84470;
    classtype:attempted-user;
    sid:10000001;
    rev:1;
)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [network where destination.port == 443 and http.request.method == "POST" and http.request.body.text contains "/api/v2/bulk/job_launch/"]
  [network where http.request.body.text contains "instance_groups"]

Splunk SPL Query

index=awx sourcetype=awx_api_logs
  method=POST
  uri="/api/v2/bulk/job_launch/"
  | rex field=request_body "\"instance_groups\"\s*:\s*\[*(?<instance_groups>[^\]]+)\]*"
  | stats count by user, src_ip, instance_groups, uri

Wazuh OSSEC Rule

<rule id="100301" level="12">
  <if_sid>50300</if_sid>
  <match>/api/v2/bulk/job_launch/</match>
  <regex>instance_groups</regex>
  <description>CVE-2026-84470: Bulk Job Launch API used with instance_groups - potential authorization bypass</description>
  <group>cve-2026-84470,awx,authentication,</group>
</rule>

Mitigation & Patch Guidance

Patch Status: UNPATCHED (confidence 0/4). No vendor fix is available from any tracked source at the time of writing.

1. Immediate Mitigations

• Disable or restrict access to the Bulk Job Launch API if it is not a critical business requirement. This can be achieved by:
  • Reverse-proxy or API-gateway rule blocking POST /api/v2/bulk/job_launch/ except from approved administrative IP ranges.
  • AWX role-based access control: eliminate execute permission on job templates for System Auditor and other read-only roles unless strictly necessary.
• Audit and restrict instance group permissions: Ensure that the read permission on instance groups is removed for all users who do not also have use permission, particularly for read-only roles like System Auditor.
• Monitor logs for anomalous bulk job launch activity, especially from low-privileged users.

2. Patch/Upgrade Steps

• Monitor Red Hat's security advisory channels for the official fix.
• Subscribe to the Ansible Automation Platform security mailing list.
• Upon release, apply the updated automation-controller package immediately after testing in a staging environment.
• Note: The affected version range is listed as empty ("[]") in available intelligence; assume all current releases are vulnerable until a patched version is confirmed.

3. Long-Term Hardening

• Enforce the Principle of Least Privilege: Rebuild the role hierarchy so that no role combines read access to instance groups with execute access to job templates without explicit use-level permission on the former.
• Implement authorization consistency testing: Add automated regression tests that compare permission checks between bulk and single-launch API endpoints.
• Network segmentation: Place the AWX controller behind additional authentication layers (e.g., SSO with MFA) and restrict API access to VPN-connected administrators if feasible.
• Periodic permission re-certification: Regularly review all RBAC role assignments with a focus on cross-resource permission combinations.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-84470
2. Red Hat Ansible Automation Platform Security Advisories: https://access.redhat.com/security/security-updates/ (check for advisories tied to CVE-2026-84470)
3. CWE-862 Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
4. AWX Project (GitHub): https://github.com/ansible/awx (monitor for security fix commits referencing CVE-2026-84470)

Threat Actor Activity Note: As of this report, no known threat actor campaigns, malicious exploitation, or proof-of-concept code has been publicly identified for CVE-2026-84470. CISA KEV does not list this CVE. The vulnerability is not yet included in the EPSS scoring system. Organizations should treat this as a high-priority unpatched exposure and implement the mitigations above.