CVE-2026-6266
High
Description
A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a victim's account or gain unauthorized access to other accounts, including administrative accounts, by manipulating the IDP-provided email.
SeverityHigh
CVSS8.3
Exploit probability—
ProductDjango-ansible-base
PublishedMay 4, 2026
First seenMay 4, 2026
Weakness typeCWE-305CWE-305
How to fix
Update
- django-ansible-base2.5.20260422, 2.6.20260422 or later
- automation-controller4.6.28, 4.7.11 or later
- automation-gateway2.5.20260422, 2.6.20260422 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| django-ansible-base | 2.5.0 ≤ v < 2.5.20260422, 2.6.0 ≤ v < 2.6.20260422 | 2.5.20260422, 2.6.20260422 |
| automation-controller | 4.6.0 ≤ v < 4.6.28, 4.7.0 ≤ v < 4.7.11 | 4.6.28, 4.7.11 |
| automation-gateway | 2.5.0 ≤ v < 2.5.20260422, 2.6.0 ≤ v < 2.6.20260422 | 2.5.20260422, 2.6.20260422 |
| ansible_automation_platform 2.5 | No range specified | — |
| ansible_automation_platform 2.6 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.