A flaw was found in Red Hat Ansible Automation Platform's automation-
controller. The bulk job launch endpoint builds workflow job nodes from client
input using a serializer that leaves the node's job reference -- a field normally
set by the workflow task manager after it spawns a child job -- writable and does
not include it in the permission validation performed for the other node fields.
An authenticated user with permission to execute a single job template can submit
a bulk job launch whose node references the identifier of any unified job in any
organization, including jobs they cannot access. The node then exposes that job's
metadata, and cancelling the attacker's workflow cancels the referenced job
through the workflow cancellation cascade, without any per-job authorization
check. Repeated, this allows a low-privileged user to cancel running jobs,
project and inventory syncs, ad hoc commands, and system jobs across all
organizations, denying automation service platform-wide.
controller. The bulk job launch endpoint builds workflow job nodes from client
input using a serializer that leaves the node's job reference -- a field normally
set by the workflow task manager after it spawns a child job -- writable and does
not include it in the permission validation performed for the other node fields.
An authenticated user with permission to execute a single job template can submit
a bulk job launch whose node references the identifier of any unified job in any
organization, including jobs they cannot access. The node then exposes that job's
metadata, and cancelling the attacker's workflow cancels the referenced job
through the workflow cancellation cascade, without any per-job authorization
check. Repeated, this allows a low-privileged user to cancel running jobs,
project and inventory syncs, ad hoc commands, and system jobs across all
organizations, denying automation service platform-wide.
No data.
| Package | CPE | Advisory | Released Date |
|---|---|---|---|
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | |||
| automation-controller-0:4.7.17-1.el9ap | cpe:/a:redhat:ansible_automation_platform:2.6::el9 | RHSA-2026:71113 | 2026-09-23T00:00:00Z |
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 24 Sep 2026 00:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The bulk job launch endpoint builds workflow job nodes from client input using a serializer that leaves the node's job reference -- a field normally set by the workflow task manager after it spawns a child job -- writable and does not include it in the permission validation performed for the other node fields. An authenticated user with permission to execute a single job template can submit a bulk job launch whose node references the identifier of any unified job in any organization, including jobs they cannot access. The node then exposes that job's metadata, and cancelling the attacker's workflow cancels the referenced job through the workflow cancellation cascade, without any per-job authorization check. Repeated, this allows a low-privileged user to cancel running jobs, project and inventory syncs, ad hoc commands, and system jobs across all organizations, denying automation service platform-wide. | |
| Title | automation-controller: automation-controller-container: automation-controller: bulk job launch allows setting a workflow node's job reference to an arbitrary unified job, enabling a low-privileged user to cancel and read metadata of jobs in other organizations | |
| First Time appeared |
Redhat
Redhat ansible Automation Platform |
|
| Weaknesses | CWE-915 | |
| CPEs | cpe:/a:redhat:ansible_automation_platform:2.6::el9 | |
| Vendors & Products |
Redhat
Redhat ansible Automation Platform |
|
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
No data.
Vulnrichment
No data.
NVD
No data.
Redhat
OpenCVE Enrichment
No data.
Weaknesses