CVE-2026-84486

Executive Summary

CVE-2026-84486 is an unauthenticated denial-of-service vulnerability in the Red Hat Ansible Automation Platform automation-controller, caused by debug scheduler endpoints that are exposed to all callers (including unauthenticated clients) and routed in production builds despite a debug gate that was only applied to the URL include. An unauthenticated remote attacker can repeatedly invoke these endpoints to seize the cluster-wide scheduler advisory lock, causing legitimate scheduler runs to be skipped and stalling job dispatch for every tenant on the affected cluster. With a CVSS base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) and no patch, workaround, or public exploit currently available, exposure is limited to reachable controller web interfaces but the availability impact to centralized automation operations is severe.

Technical Analysis

The core defect is classified as CWE-489 (Active Debug Code): functionality intended for debugging was shipped into production builds in an active, reachable state. Per the NVD description, four debug views in the automation-controller are "configured to allow any user (including unauthenticated clients)" and are "routed in production builds because their URL include is not gated on the debug setting." This is the critical distinction: the access control and routing surrounding these views were not conditioned on the platform's debug configuration flag. A debug-only URL include that should have been compiled out or disabled in production instead remained registered in the routing table, so the endpoints resolve on standard controller deployments.

The four debug views "trigger the internal task, dependency, and workflow schedulers." These are the internal scheduling components responsible for dispatching and coordinating automation work across the cluster. Critically, the internal scheduler executes under a cluster-wide scheduler advisory lock — a single mutual-exclusion primitive that prevents multiple scheduler instances from running concurrently and corrupting or duplicating dispatch. The debug views, when invoked, attempt to acquire this same advisory lock.

The abuse model is a lock-contention resource-exhaustion pattern. Because the legitimate scheduler "acquires the same lock without waiting" — i.e., it attempts a non-blocking acquisition and, on failure, simply skips the run rather than queueing — an attacker who repeatedly triggers the debug views can hold the advisory lock at the moment the real scheduler fires. Each collision causes the genuine scheduler run to be skipped entirely. Sustained repetition starves the legitimate scheduler of run opportunities, so job dispatch stalls for all tenants. The attacker does not need to manipulate jobs or data; simply holding the lock when the scheduler ticks is sufficient to deny scheduling service.

The vulnerability carries a secondary confidentiality dimension (CVSS C:L). The "debug root view additionally discloses the list of debug endpoints to unauthenticated callers." This gives an attacker an enumeration primitive — the root debug view names the other debug endpoints, removing any guesswork and directly enabling the availability attack against the enumerated scheduler-triggering views. It also leaks internal structure, which is useful for reconnaissance even beyond this specific flaw.

Attack surface: the controller's HTTP(S) web interface. No authentication is required (PR:N), no user interaction is required (UI:N), and the attack is network-reachable (AV:N) with low complexity (AC:L). The impact is scoped unchanged (S:U) — the scheduler and its lock are within the same security authority as the vulnerable component. No affected version ranges or package identifiers were provided by the tracked sources, so the precise set of vulnerable releases cannot be enumerated here; the exposure applies to production automation-controller deployments that route the affected debug URLs.

Because there is no public PoC, exploit code, or Nuclei template for this CVE, the precise endpoint paths, HTTP methods, and required parameters of the four debug views are not documented in the available data. That information is intentionally not fabricated in this report. The meaningful implementation lineage for defenders is the AWX / automation-controller debug URL registration pattern; the specific routes must be identified by inspecting the deployed controller's URL configuration rather than relying on an assumed path.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-489 active debug code leading to lock-contention denial of service) and the NVD description. No specific function names, routes, or parameters are invented.

1. Reconnaissance / target identification. The attacker identifies a reachable Red Hat Ansible Automation Platform automation-controller web interface over the network. No credentials are required for the steps that follow. To enumerate the relevant debug views, the attacker first requests the debug root view, which — per the NVD description — discloses the list of debug endpoints to unauthenticated callers. This is the enumeration primitive that turns a blind target into a known target.

2. Triggering the flaw class. Using the endpoint list returned by the debug root view, the attacker identifies the debug views that "trigger the internal task, dependency, and workflow schedulers." The attacker issues unauthenticated requests to those four debug views. Each invocation attempts to acquire the cluster-wide scheduler advisory lock — the same lock the legitimate scheduler uses. No exploit payload is needed; the mere act of calling the endpoints exercises debug code that should not have been reachable in production.

3. Execution method (vulnerability-class level). This is a request-flooding / lock-contention attack rather than a memory-corruption or injection exploit. The attacker sends repeated unauthenticated HTTP requests to the scheduler-triggering debug views in a tight loop. The goal is temporal overlap: have the attacker-triggered debug view hold the advisory lock during the instant the legitimate scheduler attempts its non-blocking acquisition. Because the legitimate scheduler "acquires the same lock without waiting," any overlap causes the real run to be skipped rather than retried. Sustained repetition converts sporadic skips into a persistent denial of scheduling service.

4. Post-exploitation impact. Every skipped scheduler run is a lost dispatch opportunity for the whole cluster. Job dispatch stalls for all tenants, not just the attacker's — the impact is cluster-wide and tenant-agnostic. Concurrently, the flood of unauthenticated requests consumes controller web workers, adding a secondary resource-drain effect that can degrade or deny other controller web functionality. The confidentiality leak (the debug endpoint list) is maintained for the duration of the attack and useful for continued targeting. No integrity or code-execution impact is described; the described outcome is availability denial plus limited information disclosure.

Impact Assessment

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H (base 8.2, High) maps directly to the described behavior:

• AV:N (Network) — the controller web interface is remotely reachable; no local access is required.
• AC:L (Low) — no special conditions, race-window engineering beyond repetition, or prior state are required; the endpoints are unauthenticated and simply callable.
• PR:N (No Privileges) — the description states the views allow "any user (including unauthenticated clients)," so zero authentication is a precondition of the attack.
• UI:N (No User Interaction) — exploitation requires no action by a legitimate operator or administrator.
• S:U (Unchanged) — the scheduler and advisory lock reside within the same security scope as the vulnerable component; no scope crossing occurs.
• C:L (Low Confidentiality) — the debug root view discloses the list of debug endpoints to unauthenticated callers, a bounded but real information leak.
• I:N (No Integrity) — no data modification is described.
• A:H (High Availability) — the central impact: real scheduler runs are skipped and job dispatch stalls for all tenants.

Business impact is concentrated on availability of centralized automation. Ansible Automation Platform is frequently the orchestration backbone for provisioning, configuration management, patching, and CI/CD-adjacent workflows. When the scheduler stalls, queued and timed jobs across every tenant silently fail to dispatch. Teams that depend on scheduled automation — compliance runs, patch windows, nightly provisioning — experience missed executions that can cascade into operational and compliance gaps while the attack persists. Blast radius is cluster-wide (all tenants) and is limited only by the attacker's ability to keep triggering the debug views. There is no public exploit, no Nuclei template, and no evidence of in-the-wild exploitation or KEV listing at the time of writing, which lowers the near-term likelihood relative to the technical severity — but the low attack complexity and zero authentication requirement mean the barrier to a competent attacker constructing this attack is small once the endpoints are known.

Detection Guidance

Sigma Rule

title: Unauthenticated Access to Ansible Automation Controller Debug Scheduler Views
id: 7c1f2b9a-4e5d-4a2f-9b3e-1a6d0c8f2e11
status: experimental
description: Detects repeated unauthenticated requests to automation-controller debug views that trigger internal task, dependency, and workflow schedulers (CVE-2026-84486). Indicators based on debug endpoint access and lock-contention DoS pattern.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84486
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: ansible
detection:
  selection_debug_path:
    cs-uri-stem|contains:
      - '/debug/'
      - '/api/debug'
  selection_unauth:
    sc-status: 200
    cs-username: ''
  timeframe: 1m
  condition: selection_debug_path and selection_unauth | count() by src_ip > 10
falsepositives:
  - Authorized administrators invoking debug endpoints during troubleshooting
  - Development or lab environments with debug routing intentionally enabled
level: high
tags:
  - attack.t1499
  - cve.2026.84486
  - cwe.489

YARA Rule

rule CVE_2026_84486_Ansible_Controller_Debug_Scheduler_Views
{
    meta:
        description = "Detects automation-controller builds that expose debug scheduler views routed without a debug gate (CVE-2026-84486)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84486"
        cve = "CVE-2026-84486"
        cwe = "CWE-489"

    strings:
        $dbg1 = "debug" ascii nocase
        $sched_task = "task" ascii nocase
        $sched_dep  = "dependency" ascii nocase
        $sched_wf   = "workflow" ascii nocase
        $sched_lock = "scheduler" ascii nocase
        $urls_root  = "urls.py" ascii
        $adv_lock1  = "advisory" ascii nocase
        $adv_lock2  = "lock" ascii nocase

    condition:
        $urls_root and $dbg1 and 2 of ($sched_*) and 1 of ($adv_lock*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84486 Ansible Automation Controller Debug Scheduler View Access - Unauthenticated DoS Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/debug"; nocase; http.header; content:"Authorization"; negate; nocase; detection_filter: track by_src, count 20, seconds 60; classtype:attempted-dos; reference:cve,2026-84486; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-84486; metadata:affected_product Ansible_Automation_Platform, attack_target Web_Server, deployment Perimeter, signature_severity Major, tag CVE_2026_84486; sid:202684486; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [network where http.request.method == "GET"
     and url.path : "/debug*"
     and not http.request.headers.authorization : "*"]
  [network where http.request.method == "GET"
     and url.path : "/debug*"
     and not http.request.headers.authorization : "*"]
  [network where http.request.method == "GET"
     and url.path : "/debug*"
     and not http.request.headers.authorization : "*"]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access OR sourcetype=ansible:controller
| search uri_path="/debug*" OR uri_path="/api/debug*"
| eval authed=if(isnull(cookie) AND isnull(authorization_header), "no", "yes")
| where authed="no"
| bin _time span=1m
| stats count AS debug_hits dc(uri_path) AS distinct_debug_paths values(uri_path) AS paths values(clientip) AS src_ips by _time, clientip
| where debug_hits > 10
| table _time, clientip, debug_hits, distinct_debug_paths, paths
| sort - debug_hits

Wazuh OSSEC Rule

<group name="ansible_automation_controller,web,attack,">
  <rule id="100846" level="0">
    <decoded_as>web-accesslog</decoded_as>
    <regex>GET\s+/debug</regex>
    <description>Base: access to automation-controller debug endpoint (CVE-2026-84486 recon)</description>
  </rule>
  <rule id="100847" level="12" frequency="10" timeframe="60">
    <if_matched_sid>100846</if_matched_sid>
    <same_source_ip />
    <description>Possible CVE-2026-84486 exploitation: repeated unauthenticated access to automation-controller debug scheduler views from same source</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, no published workaround, and no affected version ranges are available as of this report.

1. Immediate mitigations (compensating controls). Because the debug views are reachable without authentication and the root cause is routing that is not gated on a debug setting, address exposure at the network and request layer until a fix exists:
   • Restrict reachability of the controller web interface to trusted management networks via firewall/security-group rules and, where feasible, a reverse proxy or WAF. Note the AV:N / PR:N characteristics: any client that can reach the URL can attempt the attack.
   • Block or challenge unauthenticated traffic to any debug URL pattern at the edge (/debug* and the endpoints that the debug root view discloses). Use the debug root view itself, requested under controlled conditions by an administrator, to enumerate the exact routes to block on the specific deployment.
   • Apply rate limiting to unauthenticated requests against the controller, particularly to the debug routes, to reduce the ability to continuously contend for the scheduler advisory lock.
   • Minimize web-worker exhaustion headroom issues by monitoring controller worker saturation and alerting on anomalous unauthenticated request volume.
   • Restrict or remove any deployment configuration that enables debug routing in production; verify that the debug URL include is not present in production builds of the controller.
2. Patch / upgrade steps. No patch is currently available from any tracked source. Monitor the Red Hat Ansible Automation Platform / automation-controller security advisories (Red Hat CVE page and vendor errata) for an official fix, and validate any future release against the described routing behavior before trusting it as a fix. Do not rely on version numbers alone; confirm the debug routes are gated on the debug setting in the patched build.
3. Long-term hardening. Treat debug functionality as a build-time hardening concern: enforce that debug URL includes are compiled out or access-gated in production pipelines, add CI checks that fail a build if debug routes are registered without a gate, and include "active debug code" (CWE-489) in secure-code review and pre-production security scanning. Apply defense-in-depth around the controller — network segmentation, authentication for all administrative and diagnostic surfaces, edge rate limiting, and continuous monitoring of scheduler health (skipped runs, dispatch stalls) as an early indicator of this class of availability attack.

References

• NVD — CVE-2026-84486: https://nvd.nist.gov/vuln/detail/CVE-2026-84486
• Red Hat CVE Database — CVE-2026-84486 (vendor product automation-controller, Red Hat Ansible Automation Platform): https://access.redhat.com/security/cve/CVE-2026-84486
• CWE-489 — Active Debug Code: https://cwe.mitre.org/data/definitions/489.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• CISA Known Exploited Vulnerabilities Catalog (verify current status; CVE-2026-84486 was NOT listed at the time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild evidence: none. No public PoC, exploit code, or Nuclei template is available; EPSS has not yet scored this CVE; and the CVE is not in CISA KEV. No threat actor campaigns referencing this CVE were identified in the provided data.