CVE-2026-125063

This flaw affects the automation controller component of Red Hat Ansible Automation Platform. Exploitation requires an authenticated user, and any account is sufficient because the schedule preview endpoint does not require resource-level permissions. The impact is limited to denial of service of the controller web tier while the attack is sustained; there is no confidentiality or integrity impact, and service recovers once the malicious requests stop. Red Hat rates this Moderate. The recommended fix is to replace the non-anchored wildcard-prefixed regular expressions in the rrule validation with anchored patterns or explicit token searches, to parse the submitted value once instead of rescanning it for each check, and to cap the accepted rrule length at the serializer field before validation runs.

The schedule preview endpoint is available to any authenticated user and cannot be restricted by RBAC, so exposure can only be reduced by limiting API access to trusted users.