CVE-2026-84716

A flaw was found in the automation-controller instance
                  install-bundle endpoint. When a System Administrator downloads
                  an execution/hop node's install bundle, the controller signs an
                  X.509 certificate with the receptor mesh certificate authority
                  in which the Common Name, DNS subject-alternative-name, and
                  receptor node-id are taken verbatim from the caller-chosen
                  instance hostname, with a hard-coded ten-year validity, a random
                  serial, and no issuance log or revocation list. Because the
                  hostname charset validator is case-insensitive while the
                  uniqueness validator is case-sensitive, an administrator can
                  register a case variant of an existing control node's hostname
                  and obtain a mesh-CA-signed certificate that TLS peers, which
                  match hostnames case-insensitively, accept as that control node.
                  In managed/hosted deployments — where the customer holds
                  controller superuser but the platform operator runs the mesh —
                  this yields a long-lived, non-revocable mesh peer credential and,
                  with an on-path position, TLS impersonation or interception of
                  control/hybrid mesh nodes. It does not grant direct remote code
                  execution, because receptor work submission is gated by a
                  separate signing key not included in the bundle.