Ansible Automation Platform: X-Forwarded-For Header Trust (CVE-2026-84718)
CVE-2026-84718 Published on September 23, 2026
Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust
A flaw was found in the Ansible Automation Platform automation-controller. In the shipped
production configuration, the Controller trusts the client-supplied X-Forwarded-For header as
the request's client IP without verifying that it originated from a trusted proxy, and selects
the leftmost (attacker-controlled) header value. As a result, an attacker can forge the source
IP address recorded for their requests in the Controller's audit and access logs, degrading
the integrity of forensic and SIEM attribution. The flaw does not grant additional access.
Vulnerability Analysis
CVE-2026-84718 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Timeline
Reported to Red Hat.
Made public. 21 days later.
Weakness Type
Use of Less Trusted Source
The software has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.
Products Associated with CVE-2026-84718
Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.
Affected Versions
Red Hat Ansible Automation Platform 2.5 for RHEL 8:- Version 0:4.6.33-1.el8ap and below * is unaffected.
- Version 0:4.6.33-1.el9ap and below * is unaffected.
- Version 0:4.7.17-1.el9ap and below * is unaffected.
- Version 1789673739 and below * is unaffected.
- Version 1789580684 and below * is unaffected.