CVE-2026-84717

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller (affected versions not specified)

Description An unauthenticated remote attacker can enumerate Job Template and Workflow Job Template IDs that have Bitbucket Data Center webhooks configured. This is possible because the Bitbucket Data Center webhook receiver skips HMAC (Hash-based Message Authentication Code, a mechanism for verifying data integrity and authenticity) signature verification for diagnostics:ping events after the target template has been looked up. This results in a response discrepancy where the endpoint returns HTTP 200 if a template has a Bitbucket DC webhook configured and HTTP 403 otherwise, acting as an oracle for the attacker without requiring the webhook key secret.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.