A vulnerability in the Red Hat Ansible Automation Platform allows an authenticated administrator to perform TLS impersonation of control nodes due to improper certificate validation logic.

The vulnerability exists in the automation-controller install-bundle endpoint, where case-insensitive hostname validation conflicts with case-sensitive uniqueness checks. This flaw allows an authenticated user with administrative privileges to generate a mesh-CA-signed certificate that is accepted by TLS peers as a legitimate control node.

The exploitation of this vulnerability enables TLS impersonation or interception of control and hybrid mesh nodes within a managed infrastructure. While this does not grant direct remote code execution, it facilitates long-lived, non-revocable unauthorized access to mesh traffic. Given the CVSS score of 6.6, this represents a significant security risk for organizations relying on the integrity of their automation mesh, particularly in hosted or multi-tenant environments.

Immediate Action: Update to the fixed releases: Ansible Automation Platform 2.5 (0:4.6.33-1.el8ap/el9ap), 2.6 (0:4.7.17-1.el9ap or build 1789673739), or 2.7 (build 1789580684).

Proactive Monitoring: Audit existing mesh node certificates and monitor for anomalous hostname registrations or certificate issuance events that deviate from established provisioning patterns.

Compensating Controls: Restrict access to the install-bundle endpoint to only those personnel strictly required to manage infrastructure nodes. Ensure that network-level segmentation is in place to limit the impact of potential node impersonation.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability presents a medium-severity risk that could undermine the trust model of your automation mesh. Administrators must prioritize applying the provided vendor patches to ensure that certificate issuance logic is corrected and to prevent potential impersonation attacks. Failure to patch may leave your environment vulnerable to credential interception by malicious actors who have gained administrative access to the controller.