CVE-2026-84486
Gravedad CVSS v3.1:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
23/09/2026
Última modificación:
24/09/2026
Descripción
*** Pendiente de traducción *** A flaw was found in Red Hat Ansible Automation Platform&#39;s automation-<br />
controller. Four debug views that trigger the internal task, dependency, and<br />
workflow schedulers are configured to allow any user (including unauthenticated<br />
clients) and are routed in production builds because their URL include is not<br />
gated on the debug setting. An unauthenticated remote attacker can repeatedly<br />
invoke these endpoints to acquire the cluster-wide scheduler advisory lock;<br />
because the legitimate scheduler acquires the same lock without waiting, the<br />
attacker causes real scheduler runs to be skipped, stalling job dispatch for<br />
all tenants, while also consuming controller web workers. The debug root view<br />
additionally discloses the list of debug endpoints to unauthenticated callers.
Impacto
Puntuación base 3.x
8.20
Gravedad 3.x
ALTA