Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust

Description

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost (attacker-controlled) header value. As a result, an attacker can forge the source IP address recorded for their requests in the Controller's audit and access logs, degrading the integrity of forensic and SIEM attribution. The flaw does not grant additional access.

Timeline

Scores

EPSS (exploitation in 30 days)

0.14% · top 97% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

• CWE-348: Use of Less Trusted Source (opens in a new tab)All about CWE-348 and its CVEs

Affected products

• Red Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 8

  • unaffected 0:4.6.33-1.el8ap – < *

• Red Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 8

  • unaffected 0:4.6.33-1.el8ap – < *

• Red Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 9

  • unaffected 0:4.6.33-1.el9ap – < *

• Red Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 9

  • unaffected 0:4.6.33-1.el9ap – < *

• Red Hat · Red Hat Ansible Automation Platform 2.6 for RHEL 9

  • unaffected 0:4.7.17-1.el9ap – < *

• Red Hat · Red Hat Ansible Automation Platform 2.6 for RHEL 9

  • unaffected 0:4.7.17-1.el9ap – < *

• Red Hat · Red Hat Ansible Automation Platform 2.6

  • unaffected 1789673739 – < *

• Red Hat · Red Hat Ansible Automation Platform 2.7

  • unaffected 1789580684 – < *

What to do

Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Note that merely populating PROXY_IP_ALLOWED_LIST does not fully resolve the issue in the shipped Envoy-fronted deployment, because the leftmost (attacker-controlled) X-Forwarded-For entry is still selected as the client IP, and the trusted-proxy shared-secret mechanism (a valid HTTP_X_TRUSTED_PROXY header), which makes Controller prefer the trusted rightmost X-Forwarded-For entry, is not enabled by default. Updated automation-controller packages that address this flaw are available for the Ansible Automation Platform 2.5, 2.6, and 2.7 update streams; the Ansible Automation Platform 2.4 stream will not receive a fix for this issue.

References (6)

• RHSA-2026:71113 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:71114 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:71177 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• RHSA-2026:71179 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/security/cve/CVE-2026-84718 (opens in a new tab)vdb-entryx_refsource_REDHAT
• RHBZ#2527211 (opens in a new tab)issue-trackingx_refsource_REDHAT

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-84718](https://trackcve.app/badge/CVE-2026-84718.svg)](https://trackcve.app/cve/CVE-2026-84718)

Record last updated 6 Nov 2026, 01:06 UTC.