CVE-2026-84712

*** Pendiente de traducción *** A flaw was found in the automation-controller API. The<br /> unauthenticated health-check endpoint /api/v2/ping/<br /> (ApiV2PingView, AllowAny) over-serializes RBAC-gated<br /> automation-mesh data into its anonymous response, exposing the<br /> full instance inventory (node hostnames, node types, UUIDs,<br /> heartbeats, capacities, and exact versions), all instance-group<br /> names and membership, the deployment install UUID, and the<br /> active control node. A remote, unauthenticated attacker can use<br /> this to map the control plane and fingerprint software versions<br /> for targeted attacks. This flaw affects confidentiality only;<br /> it does not expose secrets, credentials, or tenant data.