An authentication bypass vulnerability in the Red Hat Ansible Automation Platform gateway allows authenticated attackers to hijack victim accounts and gain elevated privileges.

This is an authentication bypass flaw categorized under CWE-305, where the user auto-link strategy automatically connects external Identity Provider identities to existing accounts using unverified email matching, requiring low privileges to exploit over the network.

A successful exploit permits unauthorized users to hijack existing accounts, potentially acquiring administrative privileges over the automation infrastructure. This compromises the confidentiality, integrity, and availability of managed systems and sensitive operational data. The high CVSS score of 8.3 reflects the severe risk of privilege escalation and complete control over automation workflows.

Immediate Action: Apply the vendor security updates provided in Red Hat errata RHSA-2026:13508, RHSA-2026:13512, and RHSA-2026:13545 to update the affected components immediately.

Proactive Monitoring: Monitor authentication logs for unusual account linking events, unexpected privilege changes, and anomalous API access patterns.

Compensating Controls: Implement strict monitoring of Identity Provider configurations and restrict network access to the gateway interface where feasible.

Public Exploit Available: No

Given the high severity rating and the potential for complete account and administrative takeover, administrators must prioritize patching. Update all vulnerable instances of the Ansible Automation Platform to the fixed versions immediately to secure federated authentication pathways.