CVE-2026-84684: Ansible automation-controller vulnerability

Published Sep 1, 2026

Updated

A flaw was found in automation-controller (AWX). InventoryInputInventoriesList (awx/api/views/inventory.py) validates only that the attached inventory is not itself constructed, and InventoryAccess.canattach (awx/main/access.py) special- cases only the instancegroups relationship (requiring userole); the inputinventories relationship falls through to BaseAccess.canattach, which requires only canchange on the constructed inventory and read access on the source inventory -- not userole. Consequently a user who administers a constructed inventory in one organization and holds only Inventory Read on an inventory in another organization (for example an organization auditor, or a system auditor with any inventory-admin org) can POST to /api/controller/v2/inventories/{constructedid}/inputinventories/ to attach the foreign inventory; the constructed inventory sync then clones every host and host variable (including secrets) into the attacker's inventory, and the attacker -- as admin of the constructed inventory -- can launch ad hoc shell commands against those hosts or bind the inventory to a job template. Discovered internally; verified live on AAP 2.7 / automation-controller 4.8.1 (a read-only user attached a foreign inventory (204), cloned a secret host variable, and had an ad hoc shell command accepted and dispatched against the foreign host); still present on devel. Upstream: github.com/ansible/awx (awx/main/access.py InventoryAccess. canattach / BaseAccess.canattach; awx/api/views/inventory.py InventoryInputInventoriesList)

Affected Software

1 affected component

Ansible automation-controller=4.8.1

Event History

Sep 1, 2026

Data Sourced

via Red Hat·10:41 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which users can exploit this across organization boundaries?

A user must be able to change a constructed inventory in one organization and have Inventory Read access to a source inventory in another organization. The described examples include an organization auditor, or a system auditor who also has inventory-administrator access in any organization.

Does exploiting this require use-role access to the source inventory?

No. For the input_inventories relationship, the access check requires change permission on the constructed inventory and read access to the source inventory, rather than use_role on the source inventory.

What is the practical impact after a foreign inventory is attached?

Synchronizing the constructed inventory clones every host and host variable from the source inventory, including secrets, into the attacker's inventory. An administrator of that constructed inventory can then run ad hoc shell commands against those hosts or associate the inventory with a job template.

What activity should be reviewed for possible exploitation?

Review attachments made through the input_inventories relationship, particularly POST requests to /api/controller/v2/inventories/{constructed_id}/input_inventories/ where the constructed and source inventories belong to different organizations. Prioritize cases where the user had change access to the constructed inventory but only read access to the source inventory.

CVE-2026-84684: Ansible automation-controller vulnerability

Affected Software

Event History

Frequently Asked Questions

Which users can exploit this across organization boundaries?

Does exploiting this require use-role access to the source inventory?

What is the practical impact after a foreign inventory is attached?

What activity should be reviewed for possible exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this across organization boundaries?

Does exploiting this require use-role access to the source inventory?

What is the practical impact after a foreign inventory is attached?

What activity should be reviewed for possible exploitation?