CVE-2026-84474

A flaw was found in Red Hat Ansible Automation Platform&amp;#39;s automation-<br /> controller. The provisioning-callback secret (host_config_key) is exposed to<br /> users holding only the read-level view_jobtemplate permission -- both in the<br /> job template API representation and in the activity stream -- and the<br /> provisioning callback endpoint trusts a client-supplied X-Forwarded-For<br /> header to determine the calling host when the controller is deployed behind<br /> the AAP gateway with an empty proxy allow-list. By reading the secret and<br /> spoofing X-Forwarded-For to match any host in the job template&amp;#39;s inventory, a<br /> minimally privileged or unauthenticated remote attacker can launch the job<br /> template against arbitrary managed hosts using the job template&amp;#39;s credentials,<br /> resulting in privilege escalation and remote code execution on managed hosts.