Skip to content
Advisories.
red-hatCVE-2026-84717

A flaw was found in the Ansible Automation Platform automation-controller.

Medium5.3CVE-2026-84717 · Published Sep 23, 2026 · updated Sep 24, 2026

Source advisory

Affected versions

PackageAffectedFixed in
Details and references

A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target template, causing the endpoint to return HTTP 200 for a template that has a Bitbucket DC webhook configured and HTTP 403 otherwise. An unauthenticated remote attacker can use this response discrepancy as an oracle to enumerate which Job Template and Workflow Job Template IDs have Bitbucket DC webhooks configured, without knowing the secret webhook_key.

CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity from
no source yet
Weakness
CWE-204

More red-hat advisories

All
DateAdvisory
Sep 22A heap out-of-bounds write vulnerability was found in the Linux kernel's RPC-over-RDMA server reply path in net/sunrpc/xprtrdma/svc_rdma_sendto.c.
CVE-2026-13087High8.8no fix yet
Sep 22A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests.
CVE-2026-94640High7.5no fix yet
Sep 22A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the LDAP ppolicy access check can occur if a...
CVE-2026-90462Medium5.4no fix yet
Sep 22A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library.
CVE-2026-95619High7.7no fix yet
Sep 23A code execution flaw was found in Emacs, affecting versions prior to 31.2.
CVE-2026-96442High7.8fixed in GNU Emacs 31.2
Sep 23A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution.
CVE-2026-96445Medium6.8no fix yet

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.