Loading vulnerability…
CVE-2026-84719 is a missing-authorization vulnerability in Red Hat Ansible Automation Platform automation-controller's WorkflowJobTemplate copy operation. The deep-copy permission sanitizer validates cloned-node inventory, unified job template, and credential references, but does not validate preserved instance-group references; execution-environment and label references are likewise not checked. Consequently, an authorized workflow administrator can copy a workflow containing restricted placement references and administer the resulting workflow without possessing the required instance-group use role.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Copying workflow job templates can enable instance-group privilege escalation in Automation Controller.
An authorization-bypass flaw in Red Hat Ansible Automation Platform automation-controller. An organization workflow administrator can copy a workflow template and retain unauthorized instance-group references, then administer and launch jobs on those groups, including the control-plane instance group, enabling attacker-influenced automation in the control-plane execution context.
An authorization-bypass vulnerability in Ansible Automation Platform automation-controller. A user with organization workflow-admin permission can copy a workflow and launch attacker-influenced jobs on instance groups for which they lack authorization, potentially including the control-plane instance group, resulting in execution in the control-plane context.
A privilege-escalation vulnerability in automation-controller in which the WorkflowJobTemplate copy deep-copy sanitizer omits instance_groups authorization, bypassing the InstanceGroup use_role restriction and enabling control-plane instance-group access.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.