CVE-2026-84716

/// Technical description

A flaw was found in the automation-controller instance

install-bundle endpoint. When a System Administrator downloads

an execution/hop node's install bundle, the controller signs an

X.509 certificate with the receptor mesh certificate authority

in which the Common Name, DNS subject-alternative-name, and

receptor node-id are taken verbatim from the caller-chosen

instance hostname, with a hard-coded ten-year validity, a random

serial, and no issuance log or revocation list. Because the

hostname charset validator is case-insensitive while the

uniqueness validator is case-sensitive, an administrator can

register a case variant of an existing control node's hostname

and obtain a mesh-CA-signed certificate that TLS peers, which

match hostnames case-insensitively, accept as that c

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References