An authenticated bypass vulnerability in Red Hat Ansible Automation Platform allows unauthorized users to access sensitive job template data, carrying a high severity risk.

The CopyAPIView component fails to perform necessary object level role based access control (RBAC) checks during POST requests. While the API correctly validates general add permissions, it neglects to verify if the authenticated user has read access to the source job template, potentially exposing sensitive information.

This flaw allows an authenticated user to perform unauthorized actions on job templates they should not be able to access. Successful exploitation could lead to significant data compromise and unauthorized information disclosure within the automation environment. Given the CVSS score of 8.5, this vulnerability represents a high risk that should be addressed immediately to ensure the integrity and confidentiality of automation workflows.

Immediate Action: Update Red Hat Ansible Automation Platform to the version provided in the Red Hat Security Advisory RHSA-2026:71177, which contains the necessary security fixes.

Proactive Monitoring: Review audit logs for unusual POST requests directed at the CopyAPIView endpoint, particularly those involving job template cloning or copying operations.

Compensating Controls: Restrict access to the Ansible Automation Platform API to trusted users and networks, and ensure that strict RBAC policies are enforced at the organization level to minimize the potential impact of unauthorized access.

Public Exploit Available: Unknown

Organizations utilizing Red Hat Ansible Automation Platform should prioritize the application of the vendor provided security updates. Given the potential for unauthorized data access, maintaining a patched environment is essential to preventing lateral movement or information leakage. Security teams should verify the effectiveness of their RBAC configurations following the update to ensure that permissions are correctly scoped and enforced.