An authorization bypass vulnerability in Red Hat Ansible Automation Platform allows authenticated users with read-only tokens to perform unauthorized write operations, potentially leading to full system compromise.

This vulnerability, identified as CWE-279, involves incorrect execution-assigned permissions where read-only OAuth2 tokens are incorrectly permitted to perform write operations on backend components like Controller, Hub, and EDA. The attacker must already possess a valid, low-privileged authenticated token to trigger this flaw.

The vulnerability poses a severe risk to organizational automation infrastructure. Because the exploit can lead to unauthorized modifications of backend services, an attacker could manipulate automation workflows, alter configurations, or disrupt critical operational tasks. With a CVSS score of 8.5, the impact is considered High, as the breach could result in total compromise of the automation environment, depending on the scope of the attacker's assigned RBAC permissions.

Immediate Action: Update your Red Hat Ansible Automation Platform instances to the fixed versions specified in the referenced Red Hat security advisories (RHSA-2026:0360, RHSA-2026:0361, RHSA-2026:0408, or RHSA-2026:0409) immediately.

Proactive Monitoring: Audit API access logs for anomalous write requests originating from accounts that are explicitly provisioned with read-only tokens.

Compensating Controls: Implement strict network segmentation for the AAP API gateways and review existing RBAC policies to ensure the principle of least privilege is strictly enforced while the update is pending.

Public Exploit Available: No

Given the potential for unauthorized write operations across critical automation infrastructure, organizations must prioritize the application of the provided vendor patches. Ensure that all AAP nodes are updated to the versions listed in the enrichment data to prevent potential privilege escalation within the automation environment. Failure to remediate could allow an attacker to bypass intended restrictions and modify sensitive automation workflows.