CVE-2026-84712

A flaw was found in the automation-controller API. The

unauthenticated health-check endpoint /api/v2/ping/

(ApiV2PingView, AllowAny) over-serializes RBAC-gated

automation-mesh data into its anonymous response, exposing the

full instance inventory (node hostnames, node types, UUIDs,

heartbeats, capacities, and exact versions), all instance-group

names and membership, the deployment install UUID, and the

active control node. A remote, unauthenticated attacker can use

this to map the control plane and fingerprint software versions

for targeted attacks. This flaw affects confidentiality only;

it does not expose secrets, credentials, or tenant data.