CVE-2026-84712: Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership
A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory (node hostnames, node types, UUIDs, heartbeats, capacities, and exact versions), all instance-group names and membership, the deployment install UUID, and the active control node. A remote, unauthenticated attacker can use this to map the control plane and fingerprint software versions for targeted attacks. This flaw affects confidentiality only; it does not expose secrets, credentials, or tenant data.
Other sources
A missing-authorization information-disclosure flaw was found in the automation-controller API. The endpoint GET /api/v2/ping/ (also reachable as /api/controller/v2/ping/) is served by ApiV2PingView with permissionclasses=(AllowAny,) and authenticationclasses=(), making it fully anonymous by design so that the installer and load-balancer health probes can reach it. Beyond the intended liveness fields (high-availability flag and product version), the endpoint's GET handler enumerates every automation-mesh Instance (excluding hop nodes) and every InstanceGroup without any query scoping, and serializes them into the anonymous response. As a result, an unauthenticated remote attacker who can reach the Controller API learns the complete mesh inventory — each node's hostname, node type (control/hybrid/execution), UUID, last heartbeat, capacity, and exact AWX version — together with every instance group's name, capacity, and member hostnames, plus the deployment's install UUID and the active control node identifier. This is data that the authenticated /instances/ and /instancegroups/ endpoints protect behind authentication and role-based access control. Exposing it pre-authentication provides an attacker with detailed internal reconnaissance: it maps the control plane, identifies the highest-value nodes, and reveals exact software versions for targeted exploit selection. No credentials, job data, tenant data, or configuration secrets are exposed, so the confidentiality impact is limited and there is no impact on integrity or availability. The issue is that the endpoint over-serializes RBAC-gated topology into a response that is intentionally unauthenticated; the unauthenticated liveness check itself is expected behavior.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Any automation-controller deployment where an untrusted remote party can reach the anonymous ping endpoint is exposed to topology and version fingerprinting. The affected endpoint is available at both /api/v2/ping/ and /api/controller/v2/ping/.
Does an attacker need an account or any interaction from a user?
No. The endpoint permits anonymous GET requests, so an attacker only needs network access to the endpoint; no authentication, privileges, or user interaction are required.
Does the disclosed information include credentials or tenant data?
No. The disclosed data does not include secrets, credentials, or tenant data. It does expose control-plane inventory and metadata, including node hostnames, types, UUIDs, heartbeats, capacities, versions, instance-group membership, the deployment install UUID, and the active control node.