s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

CVE-2026-84718

📛 CVE Title

Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust

⬇ Download JSON

Description

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost (attacker-controlled) header value. As a result, an attacker can forge the source IP address recorded for their requests in the Controller's audit and access logs, degrading the integrity of forensic and SIEM attribution. The flaw does not grant additional access.

Overview

State
PUBLISHED
Assigner (CNA)
redhat
CVSS severity
MEDIUM
CVSS score
CVSS 4.3 / 10 4.3 4.3 / 10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Effective score
4.3 / 10 MEDIUM source: CNA overview
CWE(s)
CWE-348
Reserved
2026-09-02
Published
2026-09-23 19:40 UTC
Last updated
2026-09-24 03:41 UTC
Source
https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84718.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published
2026-09-23 20:17:18 UTC
NVD last modified
2026-09-24 04:18:02 UTC
NVD CVSS v3.1
CVSS 4.3 / 10 4.3 4.3 / 10 MEDIUM source: secalert@redhat.com
NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Exploitability subscore
2.8 / 10
Impact subscore
1.4 / 10

NVD / KEV / EPSS data refreshed 2026-09-24 04:33 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID
EUVD-2026-85613
Assigner
redhat
Published
Sep 23, 2026, 7:40:33 PM
Updated
Sep 24, 2026, 6:09:37 AM
EUVD base score (CVSS 3.1)
4.3 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EUVD-reported EPSS
0.0000
Vendors
Red Hat
Products
Red Hat Ansible Automation Platform 2.5 for RHEL 9 (patch: 0:4.6.33-1.el9ap)
Red Hat Ansible Automation Platform 2.6 for RHEL 9 (patch: 0:4.7.17-1.el9ap)
Red Hat Ansible Automation Platform 2.6 (patch: 1789673739)
Red Hat Ansible Automation Platform 2.7 (patch: 1789580684)
Red Hat Ansible Automation Platform 2.5 for RHEL 8 (patch: 0:4.6.33-1.el8ap)
Aliases
GHSA-fxxq-29xm-f392

ENISA description: A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost (attacker-controlled) header value. As a result, an attacker can forge the source IP address recorded for their requests in the Controller's audit and access logs, degrading the integrity of forensic and SIEM attribution. The flaw does not grant additional access.

EUVD references (6)

Affected products (5)
VendorProductVersionsPlatforms
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:4.6.33-1.el8ap (unaffected) —
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:4.6.33-1.el9ap (unaffected) —
Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:4.7.17-1.el9ap (unaffected) —
Red Hat Red Hat Ansible Automation Platform 2 — —
Red Hat Red Hat Ansible Automation Platform 2 — —

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (4)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

Remediations (10)

  • Pennsylvania Access To Criminal History - Home - pa
    web:epatch.pa.gov

    Why does PATCH exist? Its purpose is to better enable the public to obtain criminal history record checks. The repository was created and is maintained in accordance with Pennsylvania's Criminal History Information Act contained in Chapter 91 of Title 18, Crimes Code. This Act also directs the Pennsylvania State Police (PSP) to disseminate criminal history data to criminal justice agencies ...

    2026-09-24 11:49 UTC
  • Waterford News, Breaking News in Waterford, CT - Patch
    web:patch.com

    Waterford Latest Headlines: Waterford Open House This Weekend: A New Nantucket-Style Townhouse Near The O'Neill, Sept. 27; 🌱 Patch AM: See what's new at Mago Point's upgraded public parking ...

    2026-09-24 11:49 UTC
  • Phoenixville News, Breaking News in Phoenixville, PA - Patch
    web:patch.com

    Phoenixville Latest Headlines: 'I Believed In Him': Community Mourns Teen Killed By Gun In Norristown; 🌱 Patch AM: Fourth Wednesday Readers: "The Art Thief" and 10 more events; 6 Money Hacks ...

    2026-09-24 11:49 UTC
  • CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After ...
    web:patchstack.com

    Yesterday we wrote up CVE - 2026 -87902, the unauthenticated local file inclusion in WordPress page template resolution fixed in 7.1.2. That post covered the sink,

    2026-09-24 11:49 UTC
  • August 11, 2026—Hotpatch KB5120994 (OS Builds 26200.9106 and 26100.9106 ...
    web:support.microsoft.com

    This Hotpatch update for Windows 11, version 25H2 and 24H2 (KB5120994) includes security improvements. To learn more about differences between security updates, optional non-security preview updates, out-of-band (OOB) updates, and continuous innovation, see Windows monthly updates explained. For information on Windows update terminology, see the different types of Windows software updates. To ...

    2026-09-24 11:49 UTC
  • September 2026 Patch Tuesday | Ivanti
    web:www.ivanti.com

    Microsoft's September 2026 Patch Tuesday resolves 973 CVEs including 119 rated Critical and two zero-days, both confirmed exploited in the wild.

    2026-09-24 11:49 UTC
  • Critical Patch Updates, Critical Security Patch Updates ... - Oracle
    web:www.oracle.com

    Critical Security Patch Updates Critical Security Patch Updates provide security patches for supported Oracle on-premises products. A Critical Security Patch Update provides targeted, high-priority security fixes in a smaller, more focused format, making them easier to apply with minimal disruption.

    2026-09-24 11:49 UTC
  • Oracle
    web:www.oracle.com

    Oracle Critical Security Patch Update Advisory - August 2026 Description. A Critical Security Patch Update (CSPU) provides targeted, high-priority security fixes in a smaller, mor

    2026-09-24 11:49 UTC
  • P.A.T.C.H. Career Institute - New Home
    web:www.patchcareerinstitute.com

    CONTACT PATCH . TRAINING MAY BE MORE AFFORDABLE THAN YOU THINK. Funding and tuition assistance opportunities may be available for eligible students. READY TO GET PATCHED?

    2026-09-24 11:49 UTC
  • Home - PATCH Hawaii
    web:www.patchhawaii.org

    PATCH provides access to registered and licensed child care, offers child care subsidies to eligible families, provides child development training and ECE scholarship opportunities, and assists those interested in starting a family child care business. PATCH is a free resource hub for families, child care professionals and communities of Hawaii.

    2026-09-24 11:49 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-84718.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform:2.5::el9",
            "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9",
            "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "automation-controller",
          "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.6.33-1.el8ap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform:2.5::el9",
            "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9",
            "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "automation-controller",
          "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.6.33-1.el9ap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2.6::el10",
            "cpe:/a:redhat:ansible_automation_platform:2.6::el9",
            "cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10",
            "cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9",
            "cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "automation-controller",
          "product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:4.7.17-1.el9ap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "defaultStatus": "affected",
          "packageName": "ansible-automation-platform-26/controller-rhel9",
          "product": "Red Hat Ansible Automation Platform 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "defaultStatus": "affected",
          "packageName": "ansible-automation-platform-27/controller-rhel9",
          "product": "Red Hat Ansible Automation Platform 2",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2026-09-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the Ansible Automation Platform automation-controller. In the shipped\nproduction configuration, the Controller trusts the client-supplied X-Forwarded-For header as\nthe request's client IP without verifying that it originated from a trusted proxy, and selects\nthe leftmost (attacker-controlled) header value. As a result, an attacker can forge the source\nIP address recorded for their requests in the Controller's audit and access logs, degrading\nthe integrity of forensic and SIEM attribution. The flaw does not grant additional access."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-348",
              "description": "Use of Less Trusted Source",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T03:41:36.948Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:71113",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:71113"
        },
        {
          "name": "RHSA-2026:71114",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:71114"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-84718"
        },
        {
          "name": "RHBZ#2527211",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527211"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-02T01:18:40.552Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-09-23T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-348: Use of Less Trusted Source"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-84718",
    "datePublished": "2026-09-23T19:40:33.062Z",
    "dateReserved": "2026-09-02T01:18:24.873Z",
    "dateUpdated": "2026-09-24T03:41:36.948Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}