CVE-2026-84470

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller (AWX) (affected versions not specified)

Description An authorization flaw exists in the Bulk Job Launch API endpoint 'POST /api/v2/bulk/job launch/'. The system performs only a read-level permission check for requested instance groups, while the standard single-job launch path requires use-level permission. A user with read permission on an instance group (such as the System Auditor role) and execute permission on a job template can launch bulk jobs on unauthorized instance groups, bypassing execution-placement isolation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.