CVE-2026-84719

CVE-2026-84719 describes a flaw within the Ansible Automation Platform's automation-controller. The vulnerability arises when a WorkflowJobTemplate is copied, as the deep-copy permission sanitizer inadequately validates certain components. Specifically, it fails to check the `instance_groups`, `execution_environment`, and `labels` that are preserved from the original template, while correctly validating `inventory`, `unified_job_template`, and `credentials`. This oversight allows a user with organization workflow-admin permissions, even without specific roles on the referenced instance groups, to copy a workflow and subsequently gain administrative control over it. Consequently, this user can launch jobs on instance groups they are not authorized to access, including the control-plane instance group. This bypasses established authorization boundaries, enabling attacker-influenced automation to execute within the control-plane's execution context.