install-bundle endpoint. When a System Administrator downloads
an execution/hop node's install bundle, the controller signs an
X.509 certificate with the receptor mesh certificate authority
in which the Common Name, DNS subject-alternative-name, and
receptor node-id are taken verbatim from the caller-chosen
instance hostname, with a hard-coded ten-year validity, a random
serial, and no issuance log or revocation list. Because the
hostname charset validator is case-insensitive while the
uniqueness validator is case-sensitive, an administrator can
register a case variant of an existing control node's hostname
and obtain a mesh-CA-signed certificate that TLS peers, which
match hostnames case-insensitively, accept as that control node.
In managed/hosted deployments — where the customer holds
controller superuser but the platform operator runs the mesh —
this yields a long-lived, non-revocable mesh peer credential and,
with an on-path position, TLS impersonation or interception of
control/hybrid mesh nodes. It does not grant direct remote code
execution, because receptor work submission is gated by a
separate signing key not included in the bundle.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 | affected | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | affected | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | affected | — |
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 23 Sep 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the Common Name, DNS subject-alternative-name, and receptor node-id are taken verbatim from the caller-chosen instance hostname, with a hard-coded ten-year validity, a random serial, and no issuance log or revocation list. Because the hostname charset validator is case-insensitive while the uniqueness validator is case-sensitive, an administrator can register a case variant of an existing control node's hostname and obtain a mesh-CA-signed certificate that TLS peers, which match hostnames case-insensitively, accept as that control node. In managed/hosted deployments — where the customer holds controller superuser but the platform operator runs the mesh — this yields a long-lived, non-revocable mesh peer credential and, with an on-path position, TLS impersonation or interception of control/hybrid mesh nodes. It does not grant direct remote code execution, because receptor work submission is gated by a separate signing key not included in the bundle. | |
| Title | Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnames | |
| First Time appeared |
Redhat
Redhat ansible Automation Platform |
|
| Weaknesses | CWE-266 | |
| CPEs | cpe:/a:redhat:ansible_automation_platform:2 | |
| Vendors & Products |
Redhat
Redhat ansible Automation Platform |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2026-09-23T19:40:28.390Z
Reserved: 2026-09-02T01:03:53.834Z
Link: CVE-2026-84716
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-23T20:17:18.210
Modified: 2026-09-23T20:17:18.210
Link: CVE-2026-84716
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-09-23T20:45:09Z
-
CWE-266
Incorrect Privilege Assignment