CVE-2026-84718 is a vulnerability in Red Hat Ansible Automation Platform
Published on September 23, 2026
Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust
A flaw was found in the Ansible Automation Platform automation-controller. In the shipped
production configuration, the Controller trusts the client-supplied X-Forwarded-For header as
the request's client IP without verifying that it originated from a trusted proxy, and selects
the leftmost (attacker-controlled) header value. As a result, an attacker can forge the source
IP address recorded for their requests in the Controller's audit and access logs, degrading
the integrity of forensic and SIEM attribution. The flaw does not grant additional access.
Vulnerability Analysis
CVE-2026-84718 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Timeline
Reported to Red Hat.
Made public. 21 days later.
Weakness Type
Use of Less Trusted Source
The software has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.
Products Associated with CVE-2026-84718
Want to know whenever a new CVE is published for Red Hat Ansible Automation Platform? stack.watch will email you.