CVE-2026-84716

*** Pendiente de traducción *** A flaw was found in the automation-controller instance<br /> install-bundle endpoint. When a System Administrator downloads<br /> an execution/hop node&amp;#39;s install bundle, the controller signs an<br /> X.509 certificate with the receptor mesh certificate authority<br /> in which the Common Name, DNS subject-alternative-name, and<br /> receptor node-id are taken verbatim from the caller-chosen<br /> instance hostname, with a hard-coded ten-year validity, a random<br /> serial, and no issuance log or revocation list. Because the<br /> hostname charset validator is case-insensitive while the<br /> uniqueness validator is case-sensitive, an administrator can<br /> register a case variant of an existing control node&amp;#39;s hostname<br /> and obtain a mesh-CA-signed certificate that TLS peers, which<br /> match hostnames case-insensitively, accept as that control node.<br /> In managed/hosted deployments — where the customer holds<br /> controller superuser but the platform operator runs the mesh —<br /> this yields a long-lived, non-revocable mesh peer credential and,<br /> with an on-path position, TLS impersonation or interception of<br /> control/hybrid mesh nodes. It does not grant direct remote code<br /> execution, because receptor work submission is gated by a<br /> separate signing key not included in the bundle.