CVE-2026-84474

Executive Summary

CVE-2026-84474 is a privilege-escalation and remote-code-execution flaw (CWE-807, Reliance on Untrusted Inputs in a Security Decision) in the automation-controller component of Red Hat Ansible Automation Platform. The provisioning-callback secret (host_config_key) is exposed to any user holding only the read-level view_jobtemplate permission — both in the job template API representation and in the activity stream — and the provisioning callback endpoint trusts a client-supplied X-Forwarded-For header to determine the calling host when deployed behind the AAP gateway with an empty proxy allow-list. By reading the secret and spoofing X-Forwarded-For to match any host in the job template's inventory, a minimally privileged or unauthenticated remote attacker can launch the job template against arbitrary managed hosts using that template's stored credentials, resulting in privilege escalation and remote code execution on managed hosts. With a CVSS base score of 9.9 and scope change (S:C), the flaw crosses a security boundary — from an unprivileged controller vantage point into full execution on managed endpoints — and no patch, vendor workaround, public PoC, or Nuclei template is currently available.

Technical Analysis

The vulnerability is a compound failure combining two independent weaknesses that, chained, defeat the authorization model of Ansible Automation Platform's automation-controller.

Weakness 1 — Secret exposure to read-level users. The provisioning-callback mechanism is a legacy controller feature that allows a managed host to request its own configuration by calling back to the controller using a shared secret, the host_config_key, which is stored on the job template. That secret is intended to authenticate the calling host. Per the NVD description, the secret is disclosed to users who hold only the read-level view_jobtemplate permission. It is exposed in two distinct locations:

• the job template API representation — the serialized job template object returned through the controller's REST API; and
• the activity stream — the controller's audit/log record of changes and actions.

Both are readable by view_jobtemplate holders by design. The result is that a secret with authentication significance for a privileged operation is readable by a principal whose permission level is explicitly read-only. This is the CWE-807 core: a security decision (whether to accept a provisioning callback) depends on a value (the callback secret) that is not protected at the correct trust level.

Weakness 2 — Untrusted X-Forwarded-For in the callback authorization decision. The provisioning callback endpoint must determine which host is calling in order to match that host against the job template's inventory. When the controller is deployed behind the AAP gateway, that determination is made from a client-supplied X-Forwarded-For header. Under correct configuration, the gateway strips or overwrites this header and enforces a proxy allow-list, so the controller can trust it as gateway-injected. The NVD description states the flaw manifests when the deployment uses an empty proxy allow-list. In that configuration the header is effectively attacker-controlled: the controller accepts the caller-supplied value as the identity of the calling host. Because the inventory match is performed against attacker-supplied data, an attacker can claim the identity of any host that exists in the job template's inventory.

Chained impact: weakness 1 supplies the secret needed to pass the callback's authentication check; weakness 2 supplies the host identity needed to pass the callback's inventory/authorization check. Together they satisfy every check that stands between an unprivileged (or unauthenticated) caller and job execution. Because a job template executes playbooks with the credentials configured for the template's inventory and connection, successful callback execution means code runs, as the template's configured user, on the attacker-selected managed host — hence the CVSS scope change (S:C), where the exploited component's authority extends into managed hosts that are separate security authorities.

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H is consistent with this analysis: network-reachable, low attack complexity, low privileges required (a view_jobtemplate-only account), no user interaction, scope change, and high confidentiality, integrity, and availability impact. The impact is high on all three axes because the attacker obtains the job template's stored credentials for the target host, permitting full read/write/execute on that host and, in AaaS-style deployments using SSH credentials for inventory, potentially the ability to move laterally to other inventory hosts reachable with the same credentials.

Attack surface. The exposed surfaces are (a) the controller REST API job template representation, (b) the activity stream endpoint, and (c) the provisioning callback endpoint on the automation-controller as deployed behind the AAP gateway. The precondition for full exploitability is a deployment in which the AAP gateway's proxy allow-list is empty — i.e., the gateway is not configured to constrain which upstream proxies may set X-Forwarded-For, or the controller is reachable in a path where the header is not sanitized. This precondition is configuration-dependent, which is why the report treats affected versions as unknown: the flaw is in the product's trust model and endpoint behavior, and the vulnerable configuration is defined by deployment posture (empty proxy allow-list) rather than by a specific build number disclosed in the available data.

Availability of exploitation knowledge. There is no public PoC, no Nuclei template, and no exploit code in the tracked sources, and the CVE has no EPSS score. Exploitation still requires the attacker to obtain the secret from a live readable representation and to present a well-formed callback with a spoofed X-Forwarded-For. That is straightforward for an authenticated view_jobtemplate user and only marginally harder for an unauthenticated attacker, because the callback path is network-reachable and authentication to the callback endpoint is by shared secret (host_config_key), not by session identity. The NVD description explicitly states the attacker can be "minimally privileged or unauthenticated," meaning the secret-read step may be achievable through a separate low-privilege or unauthenticated vantage point, or the secret may be leaked through the activity stream in ways that are reachable without a full account.

Exploitation Scenarios

No public PoC is available for CVE-2026-84474; the attack chain below is inferred from the vulnerability class (CWE-807) and the mechanics described in the NVD description. Only parameters, endpoints, and permissions explicitly named in the description are used.

Step 1 — Reconnaissance and target identification. The attacker identifies an Ansible Automation Platform deployment with an automation-controller fronted by the AAP gateway. Two configuration facts matter: whether the controller's job template API representation or activity stream is reachable by a low-privilege principal, and whether the deployment runs with an empty proxy allow-list (which is what makes X-Forwarded-For attacker-controlled). The attacker enumerates job templates to learn which templates have provisioning callbacks enabled and what inventory each template is bound to, since the spoofed X-Forwarded-For value must match a host that appears in that inventory.

Step 2 — Secret acquisition. Holding only the read-level view_jobtemplate permission, the attacker reads the job template's API representation and/or the activity stream and extracts the provisioning-callback secret (host_config_key). No write permission, administrative role, or credential theft is required: the secret is disclosed by the product to a read-only principal.

Step 3 — Triggering the flaw class (untrusted input in an authorization decision). The attacker issues a provisioning-callback request to the controller's callback endpoint, supplying the stolen host_config_key to pass the secret-based check and a crafted X-Forwarded-For header asserting the IP address or identity of a host present in the target job template's inventory. Because the deployment's proxy allow-list is empty, the controller trusts the client-supplied header rather than accepting only a gateway-injected value, and resolves the caller as the spoofed host. The inventory/authorization check therefore matches against attacker-chosen input, and the caller is accepted as a legitimate provisioning target.

Step 4 — Execution against arbitrary managed hosts. With both checks satisfied, the callback launches the job template. The controller executes the template's playbook against the attacker-selected host using the credentials configured on the job template (for example, the inventory's connection credentials). The attacker controls which inventory host the job runs against, so they can direct execution to any managed host reachable with that template's credentials, not merely the host they physically control.

Step 5 — Post-exploitation impact. Execution runs with the privileges associated with the job template's credentials on the managed host, producing remote code execution and privilege escalation from the attacker's low-privilege (or unauthenticated) starting point to code execution on managed infrastructure. Because the exploited component's authority reaches into separate security boundaries — the managed hosts — the CVSS scope is changed. With template credentials that are reused across inventory, the attacker can pivot to additional managed hosts reachable with the same credentials, and can read data, modify configuration, or disrupt services on each.

Impact Assessment

The CVSS 3.1 base score is 9.9 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The subscores support a severe, broadly exploitable impact:

• Attack Vector: Network (N) — the callback endpoint and the API/activity stream representations are reachable over the network; no local access or physical adjacency is needed.
• Attack Complexity: Low (L) — once the secret is read and X-Forwarded-For is spoofable, no race conditions, no exotic preconditions beyond the deployment's proxy allow-list configuration, and no specialized exploit code are required.
• Privileges Required: Low (L) — a view_jobtemplate-only account is sufficient to read the secret. The description further notes the attacker may be unauthenticated, indicating the practical privilege floor can be even lower via the callback path.
• User Interaction: None (N) — no operator action (no click, no approval) is needed; the callback is machine-to-machine.
• Scope: Changed (C) — the vulnerability in the automation-controller yields execution authority on managed hosts, which are distinct security authorities. This is the single most important score driver and the reason the base reaches 9.9.
• Confidentiality/Integrity/Availability: High/High/High (C:H/I:H/A:H) — the attacker obtains and uses the job template's credentials, enabling full read, modification, and disruption on the targeted managed host.

Blast radius. The blast radius is governed by the job template's inventory and credential scope. A template bound to a small inventory limits direct blast radius to that inventory; a template whose connection credentials are shared across many hosts, or a service account reused across environments, expands blast radius to every host reachable with those credentials. Because the attacker can select which host to target (subject to inventory membership), impact is not confined to a single endpoint. Organizations subject to change-management or segregation-of-duties requirements also face an audit-integrity problem, since activity-stream records that disclosed the secret are themselves the source of the disclosure, and legitimate provisioning-callback executions are indistinguishable from abuse at the log level absent the detection guidance below.

Business impact. Managed hosts in an AAP inventory typically include production servers, network devices, and cloud instances under configuration management. RCE with the template's credentials can mean unauthorized configuration changes, credential theft from the managed host, service outages, destructive actions, and lateral movement into further infrastructure. For regulated environments, the loss of authorization integrity over configuration management — the system designed to enforce desired state — is a high-severity governance and compliance issue as well as a technical one.

Detection Guidance

Sigma Rule

title: Ansible Automation Platform Provisioning Callback Exploitation Attempt (CVE-2026-84474)
id: 8f2c1d6a-4b71-4e0a-9c3d-1a7b5e9f0d21
status: experimental
description: Detects provisioning-callback requests to the automation-controller carrying a client-supplied X-Forwarded-For header, indicating attempted abuse of CVE-2026-84474 where the proxy allow-list is empty and the host_config_key is reachable via view_jobtemplate.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84474
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: ansible
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/api/v2/job_templates/'
      - '/provisioning_callback'
      - '/api/v2/activity_stream/'
  selection_xff:
    cs-headers|contains: 'X-Forwarded-For'
  selection_method:
    cs-method: 'POST'
  condition: selection_path and selection_xff and selection_method
falsepositives:
  - Legitimate gateway-injected X-Forwarded-For headers on normal provisioning callbacks
  - Reverse proxy health checks
level: high

YARA Rule

rule CVE_2026_84474_Ansible_Provisioning_Callback_Abuse
{
    meta:
        description = "Detects artifacts referencing the Ansible automation-controller provisioning-callback secret and X-Forwarded-For spoofing associated with CVE-2026-84474"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84474"
        author = "valtersit.com Threat Intelligence"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $a1 = "host_config_key" ascii wide nocase
        $a2 = "provisioning_callback" ascii wide nocase
        $a3 = "job_templates" ascii wide nocase
        $a4 = "X-Forwarded-For" ascii wide nocase
        $a5 = "activity_stream" ascii wide nocase
        $b1 = "view_jobtemplate" ascii wide nocase

    condition:
        uint32(0) != 0xfeedface and
        (
            (2 of ($a*)) and $b1
        ) or
        (
            $a1 and $a4
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84474 Ansible Automation Platform Provisioning Callback Abuse via Spoofed X-Forwarded-For"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/provisioning_callback"; http.header; content:"X-Forwarded-For"; nocase; http.header; content:"host_config_key"; nocase; classtype:attempted-admin; reference:cve,CVE-2026-84474; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-84474; sid:202684474; rev:1; metadata:affected_product Ansible_Automation_Platform, attack_target Server, deployment Perimeter, signature_severity Critical, created_at 2026_01_01;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and
      http.request.method == "POST" and
      stringContains(http.request.uri, "/provisioning_callback") and
      stringContains(http.request.uri, "host_config_key") ]
  [ network where network.protocol == "http" and
      stringContains(http.request.uri, "/provisioning_callback") and
      /* X-Forwarded-For present on a client request reaching the controller
         indicates an unsanitized header path (empty proxy allow-list) */
      http.request.headers.x_forwarded_for : "*" ]

Splunk SPL Query

index=ansible OR index=web sourcetype=access_combined OR sourcetype=ansible_controller
| eval uri_lower=lower(uri)
| eval hdr_lower=lower(http_headers)
| where (like(uri_lower, "%/provisioning_callback%") OR like(uri_lower, "%/api/v2/job_templates/%") OR like(uri_lower, "%/api/v2/activity_stream/%"))
| where method="POST" AND like(hdr_lower, "%x-forwarded-for%")
| stats count values(uri) as requested_uris values(src_ip) as source_ips values(user) as users by src_ip, uri
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="ansible,web,cve-2026-84474,">
  <rule id="20268474" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">/provisioning_callback</field>
    <field name="method">POST</field>
    <field name="headers.X-Forwarded-For">\.*</field>
    <description>CVE-2026-84474: Ansible provisioning callback POST with client-supplied X-Forwarded-For (potential host_config_key abuse)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_84474,pci_dss_10.2.4,</group>
  </rule>

  <rule id="20268475" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">/api/v2/job_templates/\d+/</field>
    <field name="method">GET</field>
    <field name="response_body">host_config_key</field>
    <description>CVE-2026-84474: Job template API representation disclosed host_config_key secret to read-level request</description>
    <mitre>
      <id>T1552.003</id>
    </mitre>
    <group>cve_2026_84474,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source; there is no vendor fix and no vendor workaround listed. The following actions are configuration-level mitigations to reduce exposure until a fixed release is available and should be validated against a supported AAP version.

1. Immediate mitigations (reduce exposure now).

• Populate the AAP gateway proxy allow-list. The described precondition is an empty proxy allow-list. Explicitly configuring the gateway to be the only trusted source of X-Forwarded-For — so the controller accepts the header only when it originates from the gateway and rejects client-supplied values — removes the header-spoofing half of the chain. This is the single highest-leverage action because it breaks the inventory-identity spoofing without requiring the secret to be rotated.
• Rotate all provisioning-callback secrets (host_config_key) on every job template that has provisioning callbacks enabled, and disable provisioning callbacks on templates that do not require them. Rotated secrets invalidate any value already disclosed through the API representation or activity stream.
• Restrict and audit view_jobtemplate. Enumerate all accounts holding only view_jobtemplate and remove it where not required; treat it as a secret-bearing permission given the described exposure. Prefer role separation so that secret-bearing template fields are not visible to read-only auditors, and review the activity stream for any prior read of job template representations by low-privilege principals.
• Limit callback network reachability. Restrict access to the provisioning callback path so that only hosts that legitimately need to self-provision can reach it, and place the automation-controller behind the gateway such that direct client-to-controller callback paths are not exposed.
• Restrict job template credentials. Reduce the blast radius by ensuring job templates do not use widely shared or highly privileged service accounts; where possible, scope each template's credentials narrowly to its inventory.

2. Patch/upgrade steps.

• Monitor Red Hat's advisories and the CVE-2026-84474 NVD record for an official fixed release of the automation-controller/AAP. No fixed version is currently identified, so no upgrade target can be specified in this report.
• When a fix is published, upgrade the automation-controller and the AAP gateway together (the flaw spans both the endpoint behavior and the gateway's header handling), and re-verify the proxy allow-list configuration after the upgrade rather than assuming the patch corrects deployment posture.
• Re-rotate secrets after applying any fix, because secrets disclosed while unpatched remain valid until changed.

3. Long-term hardening.

• Treat provisioning-callback secrets as privileged credentials: do not expose them in API representations or the activity stream to read-only roles, and implement field-level redaction for secret-bearing template fields.
• Adopt a default-deny trust model for client-supplied identity headers: never derive authorization or inventory-matching decisions from X-Forwarded-For unless it is injected and validated by a trusted proxy with a non-empty allow-list.
• Enforce least privilege on the view_jobtemplate role and review it as part of routine access recertification.
• Deploy the Sigma, Suricata, Elastic, Splunk, and Wazuh detections above to catch callback requests with client-supplied X-Forwarded-For and job template representation reads that return the host_config_key field.

References

• NVD — CVE-2026-84474: https://nvd.nist.gov/vuln/detail/CVE-2026-84474
• CWE-807 — Reliance on Untrusted Inputs in a Security Decision: https://cwe.mitre.org/data/definitions/807.html
• Red Hat Product Security — Red Hat CVE database (search CVE-2026-84474; advisory pending, no fix currently published): https://access.redhat.com/security/security-updates/
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-84474 is NOT listed; exploitation in the wild not indicated by available data): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, Nuclei template, or exploit code is available for CVE-2026-84474, and no threat actor campaign or exploit-in-the-wild evidence is present in the provided data. The attack chain described in this report is inferred from the vulnerability class (CWE-807) and the mechanics stated in the NVD description.