CVE-2026-84712

Name of the Vulnerable Software and Affected Versions automation-controller (affected versions not specified)

Description A flaw in the API allows an unauthenticated remote attacker to access sensitive information via the health-check endpoint '/api/v2/ping/'. The system over-serializes RBAC-gated automation-mesh data—data normally restricted by Role-Based Access Control (RBAC)—into the anonymous response. This exposure includes the full instance inventory, such as node hostnames, node types, UUIDs, heartbeats, capacities, and exact versions, as well as instance-group names, membership, the deployment install UUID, and the active control node. This can be used to map the control plane and fingerprint software versions for targeted attacks, though it does not expose secrets, credentials, or tenant data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/api/v2/ping/' endpoint to minimize the risk of information disclosure.