Skip to content
Advisories.
red-hatCVE-2026-84719

A flaw was found in the Ansible Automation Platform automation-controller.

Critical9.9CVE-2026-84719 · Published Sep 23, 2026 · updated Sep 25, 2026

Source advisory

Affected versions

PackageAffectedFixed in
Details and references

A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of each cloned node and fails to check the instance_groups (and execution_environment and labels) that were preserved from the original. A user with organization workflow-admin permission but no role on the referenced instance groups can copy a workflow, become its administrator, and launch jobs pinned to instance groups they are not authorized to use — including the control-plane instance group — bypassing the InstanceGroup use_role boundary and causing attacker-influenced automation to run in the control-plane execution context.

CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity from
no source yet
Weakness
CWE-862

More red-hat advisories

All
DateAdvisory
Sep 22A heap out-of-bounds write vulnerability was found in the Linux kernel's RPC-over-RDMA server reply path in net/sunrpc/xprtrdma/svc_rdma_sendto.c.
CVE-2026-13087High8.8no fix yet
Sep 22A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests.
CVE-2026-94640High7.5no fix yet
Sep 22A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the LDAP ppolicy access check can occur if a...
CVE-2026-90462Medium5.4no fix yet
Sep 22A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library.
CVE-2026-95619High7.7no fix yet
Sep 23A code execution flaw was found in Emacs, affecting versions prior to 31.2.
CVE-2026-96442High7.8fixed in GNU Emacs 31.2
Sep 23A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution.
CVE-2026-96445Medium6.8no fix yet

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.