CVE-2026-84721

/// Technical description

A server-side request forgery flaw was found in the Ansible Automation Platform

automation-controller email notification backend. The email backend passes the user-supplied SMTP

host and port from a notification template directly to the SMTP client without validating that

the target is not an internal, loopback, link-local, or reserved address. An authenticated user

with organization notification-admin permission can create or modify an email notification

template pointing at an arbitrary internal address, trigger a test, and have the controller task

process open a raw TCP connection to that address. The resulting connection error is reflected

back through the notification record, providing a three-state internal port-scan oracle (open,

closed, filtered) over the control-plane's cluster network, including the in-cluster Kubernetes

API. When a shared organization template holds a stored SMTP password, redirecting the host can

also cause that credential to be transmitted to an attacker-c

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References