CVE-2026-84717

Executive Summary

CVE-2026-84717 is an information-disclosure vulnerability in the Ansible Automation Platform automation-controller. An unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already resolved the target template, allowing an unauthenticated remote attacker to distinguish templates that have a Bitbucket DC webhook configured (HTTP 200) from those that do not (HTTP 403). The impact is limited to reconnaissance — enumeration of Job Template and Workflow Job Template IDs — reflected in a CVSS base score of 5.3 (Medium).

Technical Analysis

The vulnerability resides in the webhook receiver component of the Ansible Automation Platform automation-controller that handles inbound Bitbucket Data Center webhook deliveries. Under normal operation, a webhook receiver validates the authenticity of an inbound request by verifying an HMAC signature computed with a shared secret (webhook_key). This prevents unauthenticated parties from submitting forged events that would trigger automation.

CVE-2026-84717 describes a logic flaw in the handling of diagnostics:ping events. According to the NVD description, for this specific event type the receiver "skips HMAC signature verification ... after it has already looked up the target template." In other words, the request-processing order is:

1. The receiver first resolves the target Job Template or Workflow Job Template identified in the request.
2. For diagnostics:ping events, HMAC signature verification is then skipped (or not enforced).
3. The endpoint returns HTTP 200 when the referenced template has a Bitbucket DC webhook configured, and HTTP 403 otherwise.

The observable difference between the 200 and 403 responses constitutes an oracle. Because the receiver performs template lookup before signature enforcement, an attacker who does not possess the webhook_key can still cause the receiver to reveal whether a given template ID has a Bitbucket DC webhook configured. This is an instance of CWE-204 (Observable Response Discrepancy): security-relevant state is disclosed through a behavioral/response difference rather than direct data return.

The CVSS v3.1 subscores — AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N — confirm the characteristics of the flaw: network-reachable, low attack complexity, no privileges or user interaction required, scope unchanged, and low confidentiality impact with no integrity or availability impact. The low confidentiality rating is consistent with the narrow nature of the leaked information (existence of a webhook configuration on a template, plus enumerability of template IDs), not with exposure of the secret itself. The description does not state that the webhook_key or its value is disclosed; it states the enumeration is possible "without knowing the secret webhook_key."

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE as of the supplied data. The exact affected version range is not specified in the provided NVD data, and the CNA Title field was empty. No function names, class names, or API parameter names beyond those appearing in the NVD description (diagnostics:ping, webhook_key, "Job Template", "Workflow Job Template") should be assumed.

Exploitation Scenarios

The attack chain below is inferred from the NVD description and the CWE-204 class. No public PoC exists; specific request payloads are not published and are therefore not fabricated here.

1) Reconnaissance / target identification. The attacker identifies an internet- or network-reachable Ansible Automation Platform automation-controller instance exposing the Bitbucket Data Center webhook receiver endpoint. Because the flaw is reachable pre-authentication (PR:N), no credentials are required.

2) Triggering the flaw class. The attacker sends diagnostics:ping webhook events to the Bitbucket DC webhook receiver, referencing candidate Job Template and Workflow Job Template IDs. The receiver performs its template lookup before any HMAC validation for this event type, so the request is processed regardless of the absence of a valid signature.

3) Response-oracle exploitation. The attacker observes the HTTP status code. A response of HTTP 200 indicates the referenced template has a Bitbucket DC webhook configured; HTTP 403 indicates it does not. By iterating over template ID values and recording the response code for each, the attacker constructs a map of which Job Template and Workflow Job Template IDs are webhook-enabled. This step requires no knowledge of the webhook_key.

4) Post-exploitation impact. The attacker gains an inventory of webhook-configured templates, which is valuable reconnaissance for follow-on activity: webhook-configured templates are known integration points and may be prioritized for further probing (e.g., abuse of other webhook paths, credential attacks, or social engineering). The direct impact is information disclosure only — the description does not indicate that the enumeration enables code execution, template modification, or secret exfiltration by itself.

Impact Assessment

The CVSS base score is 5.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The attack is network-reachable and requires no authentication or user interaction, which lowers the bar for exploitation. However, the confidentiality impact is rated Low: the flaw leaks only the binary fact of whether a template has a Bitbucket DC webhook configured, together with the enumerability of template IDs. There is no integrity or availability impact and no scope change, so blast radius is confined to reconnaissance value.

Affected systems are Ansible Automation Platform automation-controller deployments that expose a Bitbucket Data Center webhook receiver. Organizations using Bitbucket Data Center as an SCM with Ansible Automation Platform are the most relevant population. The practical risk is that disclosed configuration details reduce the attacker's uncertainty and support targeted follow-on attacks against automation infrastructure, which is often highly privileged. The EPSS score has not yet been assigned by FIRST.org, so no probabilistic exploitation likelihood is asserted here. CVE-2026-84717 is not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: Ansible Automation Controller Bitbucket DC Webhook Template Enumeration (CVE-2026-84717)
id: 9f2c1b7a-3d44-4c1e-9b21-7a5e6c8d0f11
status: experimental
description: Detects automated enumeration of Job Template / Workflow Job Template IDs via diagnostics:ping webhook events against the Ansible automation-controller Bitbucket DC webhook receiver.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84717
author: valtersit.com
date: 2026/01/01
logsource:
  product: ansible
  service: automation-controller
detection:
  selection_event:
    event_type: 'diagnostics:ping'
  selection_path:
    request_path|contains: 'webhook'
  selection_status:
    http_status:
      - 200
      - 403
  condition: selection_event and selection_path and selection_status
fields:
  - src_ip
  - request_path
  - http_status
  - template_id
falsepositives:
  - Legitimate Bitbucket Data Center ping events with a valid HMAC signature.
level: medium

YARA Rule

rule CVE_2026_84717_Bitbucket_Webhook_Oracle
{
    meta:
        description = "Detects attempt strings referencing diagnostics:ping Bitbucket DC webhook enumeration against Ansible automation-controller (CVE-2026-84717)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84717"
        cve = "CVE-2026-84717"
        author = "valtersit.com"
        date = "2026-01-01"
    strings:
        $ev = "diagnostics:ping"
        $bb = "bitbucket" nocase
        $wh = "webhook" nocase
        $key = "webhook_key"
    condition:
        $ev and ($bb or $wh or $key)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84717 Ansible automation-controller Bitbucket DC webhook diagnostics:ping enumeration attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"webhook"; nocase; http.request_body; content:"diagnostics:ping"; nocase; reference:cve,CVE-2026-84717; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-84717; classtype:attempted-recon; sid:202684717; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [network where network.protocol == "http" and http.request.body contains "diagnostics:ping" and url.path contains "webhook"]
  [network where network.protocol == "http" and http.response.status_code in (200, 403) and url.path contains "webhook"]

Splunk SPL Query

index=web OR index=ansible sourcetype=*access* OR sourcetype=automation_controller
(diagnostics:ping OR webhook)
| eval status=coalesce(http_status, status)
| where status=200 OR status=403
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as statuses by src, uri_path
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="ansible,cve-2026-84717,">
  <rule id="2026847" level="7">
    <decoded_as>json</decoded_as>
    <field name="event_type">diagnostics:ping</field>
    <description>CVE-2026-84717: diagnostics:ping webhook event observed on Ansible automation-controller (possible template enumeration)</description>
    <mitre>
      <id>T1592</id>
    </mitre>
  </rule>
  <rule id="2026848" level="10" frequency="10" timeframe="60">
    <if_matched_sid>2026847</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-84717: Repeated diagnostics:ping webhook events from same source (probable enumeration of webhook-enabled templates)</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The supplied data lists only NVD as a patch source and provides no vendor fix version, commit, or advisory text.

1. Immediate mitigations.

   • Where operational constraints permit, disable or restrict access to the Bitbucket Data Center webhook receiver for diagnostics:ping events until a confirmed fix is applied, or place the receiver behind an authenticated reverse proxy/network allowlist.
   • Ensure HMAC signature verification is enforced for all webhook event types, including diagnostics:ping, and that validation occurs before template lookup. This is the root-cause correction and should be confirmed in any patch.
   • Restrict network exposure of the automation-controller webhook endpoint to trusted Bitbucket Data Center source addresses.

2. Patch / upgrade steps.

   • Monitor the Ansible Automation Platform automation-controller advisory channel for a fixed release corresponding to CVE-2026-84717.
   • Because patch confidence is CLAIMED from a single source and no affected-version range was provided, verify the fix against the documentation for the specific deployed controller version before relying on it.
   • After upgrading, confirm that unauthenticated diagnostics:ping requests lacking a valid HMAC signature no longer return status codes that vary with webhook configuration (i.e., the oracle is removed).

3. Long-term hardening.

   • Standardize webhook receivers so that authentication/signature verification is performed strictly before any resource lookup or existence check, eliminating response-discrepancy oracles (CWE-204).
   • Return uniform responses for signature/authorization failures regardless of resource existence, to remove enumeration side channels.
   • Instrument controller logs and edge web logs (as in the detection rules above) to alert on repeated unauthenticated webhook probes across many template IDs.

References

• NVD — CVE-2026-84717: https://nvd.nist.gov/vuln/detail/CVE-2026-84717
• CWE-204 (Observable Response Discrepancy): https://cwe.mitre.org/data/definitions/204.html
• FIRST.org EPSS (score not yet assigned for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-84717 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Ansible Automation Platform automation-controller security advisories / release notes (no vendor advisory text was provided in the supplied data; consult the vendor's official channel for patch details).

No threat actor campaigns, public proof-of-concept, exploit code, or exploit-in-the-wild evidence for CVE-2026-84717 were provided in the supplied data.