A server-side request forgery vulnerability in Red Hat Ansible Automation Platform allows authenticated users to perform internal port scanning and intercept sensitive SMTP credentials.

This flaw is a Server-Side Request Forgery (CWE-918) within the automation-controller email notification backend. An authenticated user with organization notification-admin privileges can force the controller to connect to arbitrary internal network addresses, resulting in a port-scan oracle or the unauthorized transmission of stored SMTP passwords to external servers.

The ability to perform internal reconnaissance against the control-plane cluster network, including the Kubernetes API, poses a significant risk to infrastructure integrity. Furthermore, the potential exfiltration of stored SMTP credentials could lead to wider unauthorized access within the organization's messaging ecosystem. While the CVSS score is 6.4, the risk is elevated due to the potential for lateral movement and credential theft within an enterprise automation environment.

Immediate Action: Upgrade Red Hat Ansible Automation Platform to the fixed version (1789580684 or later) as referenced in the Red Hat Security Advisory RHSA-2026:71177.

Proactive Monitoring: Review system logs for unusual notification template modifications and unexpected outbound network connections originating from the automation-controller service.

Compensating Controls: Implement strict egress filtering on the automation-controller to prevent connections to internal, loopback, or reserved IP address ranges.

Public Exploit Available: Unknown

Security teams must prioritize patching this vulnerability to prevent potential credential theft and internal network mapping. Organizations should audit all existing notification templates for suspicious SMTP configurations and restrict administrative access to notification settings to the absolute minimum number of required personnel.