CVE-2026-84719

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller (affected versions not specified)

Description A flaw exists in the deep-copy permission sanitizer when a WorkflowJobTemplate is copied. The sanitizer validates the inventory, unified job template, and credentials of cloned nodes but fails to verify instance groups, execution environment, and labels preserved from the original. This allows a user with organization workflow-admin permissions, who lacks roles for specific instance groups, to copy a workflow and become its administrator. Consequently, they can launch jobs pinned to unauthorized instance groups, including the control-plane instance group, bypassing the use role boundary and executing attacker-influenced automation within the control-plane execution context.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.