CVE-2026-84486

A flaw was found in Red Hat Ansible Automation Platform's automation-

controller. Four debug views that trigger the internal task, dependency, and

workflow schedulers are configured to allow any user (including unauthenticated

clients) and are routed in production builds because their URL include is not

gated on the debug setting. An unauthenticated remote attacker can repeatedly

invoke these endpoints to acquire the cluster-wide scheduler advisory lock;

because the legitimate scheduler acquires the same lock without waiting, the

attacker causes real scheduler runs to be skipped, stalling job dispatch for

all tenants, while also consuming controller web workers. The debug root view

additionally discloses the list of debug endpoints to unauthenticated callers.