A flaw was found in Red Hat Ansible Automation Platform's automation-
controller. Four debug views that trigger the internal task, dependency, and
workflow schedulers are configured to allow any user (including unauthenticated
clients) and are routed in production builds because their URL include is not
gated on the debug setting. An unauthenticated remote attacker can repeatedly
invoke these endpoints to acquire the cluster-wide scheduler advisory lock;
because the legitimate scheduler acquires the same lock without waiting, the
attacker causes real scheduler runs to be skipped, stalling job dispatch for
all tenants, while also consuming controller web workers.
The debug root view additionally discloses the list of debug endpoints to unauthenticated callers.
Attack Parameters
Impact Assessment
CVSS Vector v3.1