CVE-2026-84721

Executive Summary

CVE-2026-84721 is a server-side request forgery (SSRF) vulnerability in the Ansible Automation Platform automation-controller email notification backend. An authenticated user with organization notification-admin permission can pass an arbitrary SMTP host and port through a notification template, causing the controller task process to open raw TCP connections to internal, loopback, link-local, or reserved addresses and reflect connection errors through the notification record. This yields an internal port-scan oracle over the control-plane cluster network, including the in-cluster Kubernetes API, and can exfiltrate a stored SMTP password to an attacker-controlled server.

Technical Analysis

The vulnerability lies in the automation-controller component of Ansible Automation Platform, specifically within the email notification backend. When an email notification template is created or modified, user-supplied SMTP host and port values are passed directly to the SMTP client without validation that the destination is not an internal, loopback, link-local, or reserved address. Because the controller task process runs server-side and makes the outbound TCP connection, this induces classic SSRF (CWE-918).

The lack of network-layer destination validation is the root cause. An authenticated user holding organization notification-admin permission controls the SMTP host and port fields. Triggering a notification test causes the automation-controller task process to attempt a raw TCP connection to the chosen address. The resulting connection error (for example, connection refused, timeout, or successful TCP handshake followed by protocol error) is stored and reflected back through the notification record. This reflection transforms the SSRF into a three-state port-scan oracle: open, closed, or filtered. The scan is performed from the controller's position on the cluster network, so it can enumerate reachable services, including the in-cluster Kubernetes API endpoint.

A secondary impact arises when a shared organization notification template contains a stored SMTP password. If an attacker repoints the SMTP host to an attacker-controlled server, the backend may transmit that stored credential during the SMTP session, resulting in credential disclosure. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N indicates network attack vector, low attack complexity, low privileges required, no user interaction, changed scope, low confidentiality impact, low integrity impact, and no availability impact. The changed scope (S:C) reflects that exploitation of the notification subsystem can affect resources beyond the vulnerable component, such as other cluster services and the Kubernetes API.

No public proof-of-concept, exploit code, or Nuclei template is available. No affected version range is published, and no vendor fix or workaround is documented as of this report. EPSS has not scored this CVE, and it is not listed in CISA KEV.

Exploitation Scenarios

No public PoC available; attack chain is inferred from the vulnerability class (SSRF via unvalidated SMTP host and port).

1. Reconnaissance and target identification: An attacker first obtains authenticated access with organization notification-admin permission. This is a privileged but non-administrative role scoped to notification management. The attacker identifies the automation-controller interface and the notification template configuration surface.

2. Triggering the flaw class: The attacker creates or modifies an email notification template, supplying an arbitrary SMTP host and port. Because the backend does not validate the destination, the attacker can specify internal, loopback, link-local, or reserved address ranges. The attacker then triggers a test of the notification.

3. Payload and execution at the vulnerability-class level: The automation-controller task process initiates a raw TCP connection to the attacker-specified host and port. No application-layer payload is required; the mere attempt to connect is the probe. The resulting connection outcome (open, closed, or filtered) is recorded and reflected back in the notification record, giving the attacker a three-state port-scan oracle. By iterating host and port combinations, the attacker enumerates reachable services on the control-plane's cluster network, including the in-cluster Kubernetes API.

4. Post-exploitation impact: The port-scan oracle maps internal services reachable from the controller. If a shared organization template holds a stored SMTP password, the attacker repoints the SMTP host to an attacker-controlled server and triggers a test, causing the stored credential to be transmitted to the attacker. That credential may enable further access to mail infrastructure or related systems. The changed-scope CVSS rating reflects the potential to pivot from the notification subsystem toward other cluster components.

Impact Assessment

The confidentiality impact is low (C:L) and integrity impact is low (I:L), with no availability impact (A:N). However, the changed scope (S:C) means exploitation can affect resources beyond the vulnerable email notification backend. The primary impact is internal network reconnaissance via the three-state port-scan oracle over the control-plane's cluster network, including the in-cluster Kubernetes API. This exposes the internal topology and reachable services to an authenticated low-privilege user.

The secondary impact is credential disclosure: a stored SMTP password in a shared organization notification template can be redirected to an attacker-controlled server, resulting in transmission of that credential. Business impact includes loss of internal network confidentiality, potential lateral movement toward cluster services, and credential compromise. The blast radius includes the automation-controller host, the cluster network it can reach, and any systems that trust the stored SMTP credential. Because exploitation requires only authenticated access with notification-admin permission and no user interaction, the barrier is moderate but realistic for an insider or an attacker who has compromised a low-privilege account.

Detection Guidance

Sigma Rule

title: Potential Ansible Automation Controller SSRF via Email Notification Template
id: 6f3a2c9e-8472-4b1e-9c1a-2d7f5a8b0e14
status: experimental
description: Detects creation or modification of email notification templates with internal, loopback, link-local, or reserved SMTP hosts in Ansible Automation Platform automation-controller.
author: Threat Intelligence
date: 2026-01-01
logsource:
  product: ansible
  service: automation_controller
detection:
  selection_action:
    action:
      - notification_template_create
      - notification_template_update
      - notification_test
  selection_host:
    smtp_host|re:
      - '^127\.'
      - '^10\.'
      - '^192\.168\.'
      - '^172\.(1[6-9]|2[0-9]|3[01])\.'
      - '^169\.254\.'
      - '^localhost$'
  condition: selection_action and selection_host
falsepositives:
  - Legitimate internal SMTP relay configuration by administrators
level: medium
tags:
  - attack.t1190
  - cwe.918

YARA Rule

rule CVE_2026_84721_Ansible_SSRF_SMTP
{
    meta:
        description = "Detects suspicious SMTP host values targeting internal or loopback addresses in Ansible automation-controller notification configuration"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-84721"
        severity = "medium"
    strings:
        $smtp = "smtp_host" ascii nocase
        $port = "smtp_port" ascii nocase
        $loop = "127.0.0.1" ascii
        $local = "localhost" ascii nocase
        $link = "169.254." ascii
        $rfc1918a = "10." ascii
        $rfc1918b = "192.168." ascii
    condition:
        ($smtp or $port) and any of ($loop, $local, $link, $rfc1918a, $rfc1918b)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET 25 (msg:"CVE-2026-84721 Ansible Automation Controller SSRF SMTP Notification Probe"; flow:to_server,established; content:"EHLO"; nocase; sid:202684721; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-84721, cwe CWE-918;)
alert tcp $HOME_NET any -> $HOME_NET 587 (msg:"CVE-2026-84721 Ansible Automation Controller SSRF SMTP Submission Probe"; flow:to_server,established; content:"EHLO"; nocase; sid:202684722; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-84721, cwe CWE-918;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [process where event.action == "start" and process.name : ("ansible", "awx", "automation-controller")]
  [network where destination.ip : ("127.0.0.0/8", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "169.254.0.0/16") and network.transport == "tcp" and destination.port in (25, 465, 587, 2525)]

Splunk SPL Query

index=ansible sourcetype=automation_controller (action="notification_template_create" OR action="notification_template_update" OR action="notification_test")
| eval dest=smtp_host
| where match(dest, "^(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.)") OR dest="localhost"
| stats count min(_time) as first_seen max(_time) as last_seen values(smtp_port) as ports by user, dest
| sort - count

Wazuh OSSEC Rule

<group name="ansible,automation_controller,cve-2026-84721,">
  <rule id="100847" level="10">
    <decoded_as>json</decoded_as>
    <field name="action">notification_template_(create|update|test)</field>
    <field name="smtp_host">^127\.|^10\.|^192\.168\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^169\.254\.|^localhost$</field>
    <description>CVE-2026-84721: Ansible automation-controller email notification template configured with internal SMTP host - potential SSRF</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Restrict organization notification-admin permission to only fully trusted users. Audit existing email notification templates for SMTP hosts pointing at internal, loopback, link-local, or reserved addresses and remove or correct them. Remove stored SMTP passwords from shared organization templates where possible, and rotate any credential that may have been present in a shared template. Apply network segmentation or egress controls so the automation-controller task process cannot reach sensitive internal services such as the in-cluster Kubernetes API. Monitor notification template create, update, and test actions for destination values in private and special-use ranges.

2. Patch/upgrade steps: No vendor patch or fixed version is currently documented (patch confidence 0/4). Monitor the Ansible Automation Platform vendor advisories and the NVD entry for CVE-2026-84721 for a fixed release. Until a fix is published, do not rely on version upgrades as a remediation and apply the mitigations above.

3. Long-term hardening: Enforce server-side validation that blocks SMTP host destinations resolving to internal, loopback, link-local, or reserved address ranges. Adopt an allowlist model for outbound notification destinations. Isolate the automation-controller control plane from sensitive cluster services. Apply least privilege to notification-admin roles and periodically review notification templates and stored credentials.

References

• NVD — CVE-2026-84721: https://nvd.nist.gov/vuln/detail/CVE-2026-84721
• MITRE CWE-918 Server-Side Request Forgery: https://cwe.mitre.org/data/definitions/918.html
• FIRST EPSS: https://www.first.org/epss/ (no score currently published for CVE-2026-84721)
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-84721 not listed)
• Ansible Automation Platform security advisories: https://access.redhat.com/security/ (monitor for a referenced fix)

No threat actor campaign or exploit-in-the-wild evidence is available for CVE-2026-84721 at this time. No public PoC, exploit code, or Nuclei template has been observed.