A critical authorization bypass vulnerability in Red Hat Ansible Automation Platform allows low-privileged users to execute unauthorized automation within the restricted control-plane context.

This flaw exists due to an incomplete permission check during the copying of WorkflowJobTemplates. An authenticated user with workflow-admin privileges can bypass InstanceGroup use-role boundaries to execute jobs on unauthorized infrastructure, including the sensitive control-plane execution context.

The ability to execute automation within the control-plane context poses a severe risk to the integrity and confidentiality of the entire automation infrastructure. An attacker could potentially escalate privileges, manipulate managed systems, or gain unauthorized access to credentials and sensitive environment data. Given the CVSS score of 9.9, this vulnerability represents an extreme risk to organizational security posture.

Immediate Action: Apply the relevant security updates provided in Red Hat Security Advisories RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71115, RHSA-2026:71177, or RHSA-2026:71179 depending on your specific version and RHEL platform.

Proactive Monitoring: Review audit logs for suspicious workflow creation or modification events, specifically looking for jobs initiated by users who do not typically hold permissions for the underlying instance groups.

Compensating Controls: Restrict workflow-admin privileges to only trusted personnel and enforce strict role-based access control (RBAC) policies on all instance groups until the patches are applied.

Public Exploit Available: No

This vulnerability presents a critical threat to the security and stability of your Ansible Automation Platform. Administrators must prioritize the deployment of the vendor-provided patches immediately to prevent unauthorized code execution within the control plane. Failure to remediate this issue could result in full compromise of the automation controller and the systems it manages.