CVE-2026-84718

Executive Summary

CVE-2026-84718 is a log-spoofing vulnerability in the Ansible Automation Platform automation-controller. In its shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying the header originated from a trusted proxy, and it selects the leftmost (attacker-controlled) value. An authenticated, network-positioned attacker can therefore forge the source IP recorded for their requests in audit and access logs, degrading the integrity of forensic and SIEM attribution. The flaw does not grant additional access; its impact is confined to the integrity of log data (CVSS 4.3, C:N/I:L/A:N).

Technical Analysis

The vulnerability class is CWE-348: Use of Less Trusted Source. This class describes a situation in which a system takes a security-relevant value from a source that is less trustworthy than an alternative source that is available, and treats it as though it came from the more-trusted source. In this case, the Controller treats the HTTP X-Forwarded-For request header — which any HTTP client can set freely — as authoritative for the client IP address.

X-Forwarded-For is a de-facto standard header defined for reverse proxies. When a request passes through an intermediary, the proxy appends the originating client address, producing a comma-separated list such as client, proxy1, proxy2. By convention, the leftmost value is intended to be the original client and the rightmost values are the proxies that forwarded the request. Trust models for this header depend entirely on two conditions being enforced by the receiving server:

1. The server must only honor X-Forwarded-For when the immediate TCP peer is a trusted proxy (an allow-list of proxy IPs/CIDRs).
2. When a trusted proxy is present, the server must select the address that the trusted proxy appended, not the attacker-supplied leftmost value that the client could have injected.

Per the NVD description, the shipped production configuration of the automation-controller violates both conditions: it consumes the client-supplied header without verifying that it came from a trusted proxy, and it selects the leftmost value — the one an attacker can control directly. The result is that any client capable of reaching the Controller's HTTP endpoint can cause an arbitrary IP address to be recorded as the source of its requests in the Controller's audit and access logs.

The affected attack surface is the Controller's HTTP front end and whatever middleware/logging layer derives the client IP for log records. The CVSS vector indicates a network-reachable flaw (AV:N) requiring low privileges (PR:L) — consistent with an authenticated Controller user (or a client with a valid session/token) sending requests that are logged under a forged source IP. No user interaction is required (UI:N), and the scope is unchanged (S:U).

There is insufficient technical detail available in the supplied data to name the specific middleware, HTTP framework, setting, or configuration key that reads X-Forwarded-For. No public PoC exists, so the precise request/response behavior cannot be verified from the provided intelligence. The mechanism is, however, fully characterized at the vulnerability-class level: header trust without proxy allow-listing, plus leftmost-value selection — the canonical X-Forwarded-For spoofing pattern.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-348) and the NVD description. No specific function names, endpoints, or parameters are asserted beyond those appearing in the description.

1. Reconnaissance / target identification. The attacker identifies an Ansible Automation Platform automation-controller instance reachable over the network, and obtains a low-privileged account or session (CVSS PR:L) with which they can issue requests that are written to audit and access logs.

2. Triggering the flaw. There is no memory-corruption, injection payload, or exploit primitive to construct. The attacker simply includes an X-Forwarded-For header in a normal HTTP request to the Controller, setting its value (typically the leftmost token in the comma-separated list) to an arbitrary IP address of their choosing — for example, an internal address, a decoy third-party address, a trusted administrator's address, or a reserved/blackhole address.

3. Payload / execution method. The "payload" is the header value itself. Because the shipped production configuration neither verifies that the header came from a trusted proxy nor ignores the attacker-controlled leftmost entry, the Controller records the forged value as the request's client IP in its audit and access logs. Repeated or automated requests allow the attacker to populate logs with consistent or shifting forged sources.

4. Post-exploitation impact. The flaw grants no additional access. Its effect is entirely on log integrity: incident responders, forensic timelines, and SIEM correlation rules that key on source IP will attribute the attacker's activity to the forged addresses. This can suppress or misdirect alerts (e.g., activity that should have come from an external IP now appears to originate from an internal or allow-listed address), pollute allow-list/deny-list analytics, and lead investigators to the wrong host. Where log-integrity requirements apply (PCI DSS, SOX, HIPAA audit provisions), forged-source entries undermine the evidentiary value of the logs.

Impact Assessment

Confidentiality: None (C:N), Integrity: Low (I:L), Availability: None (A:N), Scope: Unchanged (S:U), Base score 4.3 (Medium).

The only impact axis affected is integrity, and only to a limited degree — hence the I:L subscore. The attacker cannot escalate privileges, exfiltrate data, or disrupt service through this flaw. The blast radius is confined to the fidelity of the automation-controller's audit and access logs and to any downstream system that consumes those logs.

Business impact is a function of how the organization uses Controller logs:

• SOC / SIEM operations: alerts and correlation rules keyed on client_ip or source-IP geo/ASN enrichment will mis-attribute attacker activity, potentially suppressing true positives or generating false positives. Detection engineering that relies on source-IP reputation is degraded.
• Incident response and forensics: timelines reconstructed from Controller logs may point to the wrong origin host, slowing containment and root-cause analysis.
• Compliance and audit: organizations subject to log-integrity requirements may find Controller logs insufficiently trustworthy as evidence during that window.
• Scope boundary: because no access is gained, the flaw is not an initial-access or lateral-movement vector in itself. However, an actor who does have legitimate low-privileged access can use this technique as an anti-forensic step to complicate attribution of other activity they perform.

Affected systems are Ansible Automation Platform deployments running the automation-controller with the shipped production configuration. Affected version ranges are not specified in the available data.

Detection Guidance

Detection for this CVE is inherently awkward: the attack is log manipulation, so the forged records themselves are the artifact. Defenses cluster around (a) detecting malformed or suspicious X-Forwarded-For values at the network/edge layer, and (b) correlating Controller log entries against authoritative edge-proxy logs.

Sigma Rule

title: Ansible Automation Controller X-Forwarded-For Header Spoofing Attempt
id: 9f1c2a77-4b6e-4d3a-9e7b-2c8a51d0f4e3
status: experimental
description: Detects requests to the Ansible Automation Platform automation-controller
  carrying a client-supplied X-Forwarded-For header directly from an untrusted client,
  consistent with CVE-2026-84718 source-IP spoofing in logs.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84718
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: ansible
detection:
  selection_header:
    cs-header|contains: 'X-Forwarded-For'
  filter_trusted_proxy:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_header and not filter_trusted_proxy
falsepositives:
  - Legitimate reverse proxies not in the allow-list above
  - Load balancers placing X-Forwarded-For on inbound requests
level: low
tags:
  - attack.defense_evasion
  - attack.t1070
  - cve.2026.84718

Note: the cidr allow-list must be tuned to the environment's actual trusted proxy ranges before deployment; the above is illustrative of the logic, not a universal list.

YARA Rule

rule CVE_2026_84718_Ansible_XForwardedFor_Spoof
{
    meta:
        description = "Detects HTTP requests carrying spoofable X-Forwarded-For headers targeting Ansible Automation Platform automation-controller (CVE-2026-84718)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84718"
        severity = "low"

    strings:
        $hdr = "X-Forwarded-For:" ascii nocase
        $m1  = "GET /" ascii
        $m2  = "POST /" ascii
        $m3  = "PUT /" ascii
        $m4  = "PATCH /" ascii
        $ansi = "Ansible" ascii nocase

    condition:
        $hdr and any of ($m*) and filesize < 8192
}

This rule targets captured request artifacts (pcap payloads or log extracts) rather than files. It flags HTTP requests carrying the header; an analyst must then determine whether the client was a trusted proxy.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84718 Ansible Controller X-Forwarded-For Spoofing Attempt"; flow:established,to_server; http.header; content:"X-Forwarded-For:"; nocase; pcre:"/X-Forwarded-For:\s*[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\s*,/i"; classtype:attempted-recon; reference:cve,2026-84718; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-84718; sid:202684718; rev:1;)

The pcre matches a leading IP followed by a comma — i.e., a client that is itself prepending an address ahead of a proxy-appended value, the signature of leftmost-value injection. Tune flow direction and any source ranges to exit to the Controller service.

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where network.protocol == "http" and
      http.request.headers.x-forwarded-for : * and
      source.ip not in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16") ]

This EQL sequence surfaces HTTP requests to the Controller carrying an X-Forwarded-For header whose immediate TCP source is not a known trusted proxy range. As with the Sigma rule, the CIDR list must reflect the environment's real proxy infrastructure.

Splunk SPL Query

index=ansible_controller sourcetype=ansible:controller:access
| eval xff=coalesce(x_forwarded_for, dest_client_ip, client_ip)
| rex field=xff "^(?<leftmost_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| where isnotnull(leftmost_ip)
| lookup trusted_proxies src_ip OUTPUT is_trusted
| where isnull(is_trusted)
| stats count min(_time) as first_seen max(_time) as last_seen values(http_method) as methods by leftmost_ip, src_ip, dest
| sort - count

This query extracts the leftmost X-Forwarded-For value and the actual TCP source, then filters to requests that did not arrive from a trusted proxy, and aggregates by the forged and real addresses. It assumes a trusted_proxies lookup exists in the environment.

Wazuh OSSEC Rule

<group name="ansible,web,cve_2026_84718,">
  <rule id="2026847" level="3">
    <decoded_as>x-forwarded-for</decoded_as>
    <match>X-Forwarded-For:</match>
    <description>CVE-2026-84718: request to Ansible automation-controller carrying client-supplied X-Forwarded-For header</description>
    <mitre>
      <id>T1070</id>
    </mitre>
    <group>cve_2026_84718,</group>
  </rule>

  <rule id="2026848" level="6">
    <if_sid>2026847</if_sid>
    <srcip negate="yes">10.0.0.0/8,172.16.0.0/12,192.168.0.0/16</srcip>
    <description>CVE-2026-84718: X-Forwarded-For header received from non-proxy source — possible log spoofing</description>
    <group>cve_2026_84718,</group>
  </rule>
</group>

The <srcip negate="yes"> list must be replaced with the organization's actual trusted proxy ranges. Rule 2026847 gives context; 2026848 raises severity when the header arrives from somewhere other than a known proxy.

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed). No vendor advisory or specific patched version is available in the supplied data. Treat any patch claim as unverified until an authoritative Ansible/Red Hat advisory is located.

1) Immediate mitigations (before a confirmed patch is available):

• Do not trust the Controller's own client-IP field. Configure SIEM ingestion so that source IP for Controller events is derived from the authoritative edge proxy or load-balancer logs rather than from the Controller log's client-IP field.
• Enforce proxy allow-listing at the edge. Ensure the Controller service is only reachable through the trusted reverse proxy, so no client can connect directly and inject X-Forwarded-For. Network policy / firewall rules that restrict inbound access to the Controller HTTP port to the proxy IPs are the single most effective compensating control.
• Sanitize X-Forwarded-For at the edge proxy. Have the fronting proxy strip or overwrite any client-supplied X-Forwarded-For header before forwarding, and have it append the true client address itself, so the value arriving at the Controller is trustworthy regardless of the Controller's own trust logic.
• Hunt the logs. Use the detection queries above to identify historical entries whose recorded source does not match the edge proxy's record of the same request, and flag the window during which attribution may be unreliable.

2) Patch / upgrade steps:

• Monitor the NVD entry (see References) and the vendor's official Ansible Automation Platform security advisories for a confirmed fix and the exact patched release. The supplied data contains no version range and no vendor fix reference.
• Once a patched version is available, test in a staging environment and roll out to the Controller per standard Ansible Automation Platform upgrade procedures. Verify after upgrade that the Controller ignores untrusted X-Forwarded-For values.
• Because patch confidence is only 2/4, do not treat the existence of a fix as confirmed until an authoritative advisory independently corroborates it.

3) Long-term hardening:

• Maintain a formal, documented allow-list of trusted proxies and enforce it consistently at every tier that consumes forwarding headers.
• Standardize on the convention of selecting the rightmost untrusted-hop value (or the proxy-appended value), never the leftmost client-controlled token, for all services that record client IP from forwarding headers — and audit other components for the same CWE-348 anti-pattern.
• Treat audit/access logs as integrity-protected data: ship them to write-once or append-only storage, and cross-validate Controller logs against independent edge-proxy logs as a matter of routine.
• Include log-source-attribution checks in regular detection-engineering reviews, since anti-forensic techniques like this reduce the value of downstream analytics without triggering access-control alarms.

References

1. NVD — CVE-2026-84718: https://nvd.nist.gov/vuln/detail/CVE-2026-84718
2. MITRE CWE-348, Use of Less Trusted Source: https://cwe.mitre.org/data/definitions/348.html
3. MITRE ATT&CK T1070, Indicator Removal: https://attack.mitre.org/techniques/T1070/
4. Red Hat Product Security / Ansible Automation Platform security advisories (vendor advisory portal): https://access.redhat.com/security/
5. FIRST EPSS: no EPSS score was available for this CVE at the time of writing; check https://www.first.org/epss/ for updates. CISA KEV: this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and no public PoC, Nuclei template, or exploit code is known. No threat-actor campaign or exploit-in-the-wild evidence is associated with CVE-2026-84718 in the data provided.