CVE-2026-84712

A flaw was found in the automation-controller API. The
                  unauthenticated health-check endpoint /api/v2/ping/
                  (ApiV2PingView, AllowAny) over-serializes RBAC-gated
                  automation-mesh data into its anonymous response, exposing the
                  full instance inventory (node hostnames, node types, UUIDs,
                  heartbeats, capacities, and exact versions), all instance-group
                  names and membership, the deployment install UUID, and the
                  active control node. A remote, unauthenticated attacker can use
                  this to map the control plane and fingerprint software versions
                  for targeted attacks. This flaw affects confidentiality only;
                  it does not expose secrets, credentials, or tenant data.