CVE-2026-84712
MediumCVSS 5.3Summary
In the automation-controller API, the unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory (node hostnames, node types, UUIDs, heartbeats, capacities, and exact versions), all instance-group names and membership, the deployment install UUID, and the active control node. A remote, unauthenticated attacker can use this to map the control plane and fingerprint software versions for targeted attacks. This flaw affects confidentiality only; it does not expose secrets, credentials, or tenant data.
Risk Assessment
An unauthenticated attacker can obtain a detailed infrastructure map and exact software versions, facilitating targeted attack planning. Although no secrets are exposed, disclosure of inventory and versions significantly raises risk.
Recommendation
Update automation-controller to a version where /api/v2/ping/ does not serialize automation-mesh data or instance inventory. Restrict access to the health-check endpoint and monitor for unusual requests to it.
Other vulnerabilities in automation-controller
See all- CVE-2026-84716Medium
A flaw exists in the automation-controller install-bundle endpoint. A System Administrator can register a case variant of an existing control node's hostname and obtain an X.509 certificate signed by the receptor mesh CA, valid for ten years, with no issuance log or revocation list. Because the hostname charset validator is case-insensitive while the uniqueness validator is case-sensitive, TLS peers accept the certificate as that control node.
- CVE-2026-84713Medium
A flaw in the automation-controller notification subsystem causes the recipient value from NotificationTemplate.notification_configuration to be copied in clear text into the unprotected Notification.recipients field on every send. Because the credential-types endpoint is listable by any authenticated user and the API filter backend traverses object relations without per-hop authorization, a user with no privileges can use a relational filter as a boolean count-oracle to recover, character by character and across organizations, the secret recipient values of other tenants' notifications, including PagerDuty service keys and Slack/Mattermost/RocketChat/Webhook bearer-token URLs. This flaw affects confidentiality.
Original NVD description (English source)
A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory (node hostnames, node types, UUIDs, heartbeats, capacities, and exact versions), all instance-group names and membership, the deployment install UUID, and the active control node. A remote, unauthenticated attacker can use this to map the control plane and fingerprint software versions for targeted attacks. This flaw affects confidentiality only; it does not expose secrets, credentials, or tenant data.