CVE-2026-94416

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform (affected versions not specified)

Description An authorization bypass exists in the gateway API that allows an authenticated administrator to create a new service key for the Controller service cluster. Since this process is not restricted to the installer-provisioned path, the resulting key can be used to forge a service-authentication token to impersonate the Controller service. When the gateway OIDC workload-identity endpoint is enabled via FEATURE OIDC WORKLOAD IDENTITY ENABLED, an attacker can force the gateway to sign Workload Identity Tokens (WITs) for arbitrary Controller workloads. Consequently, a downstream resource server trusting the gateway OIDC key may accept the forged WIT and disclose secrets bound to that workload.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.