{"cve":"CVE-2026-84486","nvd":{"published":"2026-09-23T19:19:40.093","modified":"2026-09-24T06:17:02.153","status":"Awaiting Analysis","description":"A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. Four debug views that trigger the internal task, dependency, and\nworkflow schedulers are configured to allow any user (including unauthenticated\nclients) and are routed in production builds because their URL include is not\ngated on the debug setting. An unauthenticated remote attacker can repeatedly\ninvoke these endpoints to acquire the cluster-wide scheduler advisory lock;\nbecause the legitimate scheduler acquires the same lock without waiting, the\nattacker causes real scheduler runs to be skipped, stalling job dispatch for\nall tenants, while also consuming controller web workers. The debug root view\nadditionally discloses the list of debug endpoints to unauthenticated callers.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","score":8.2},"cwes":["CWE-489"],"references":["https://access.redhat.com/errata/RHSA-2026:71113","https://access.redhat.com/errata/RHSA-2026:71177","https://access.redhat.com/errata/RHSA-2026:71179","https://access.redhat.com/security/cve/CVE-2026-84486","https://bugzilla.redhat.com/show_bug.cgi?id=2527085"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:56:02.509636177+00:00"},"epss":{"cve":"CVE-2026-84486","score":0.00653,"percentile":0.51296,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}