CVE-2022-2568

What it actually does

A remote authenticated user granted 'change user' permissions can alter superuser account settings including removal of elevated privileges on the Ansible Automation Platform.

Why it matters to the business

Attackers can degrade administrative controls, increasing risk of unauthorized changes to automation systems and potentially disrupting critical IT operations across Red Hat environments.

How an attack unfolds

An attacker with a low-privileged account that has change-user rights authenticates to the platform and issues requests that modify superuser account attributes, stripping elevated access without needing direct superuser credentials.

How to fix it

Apply the latest security updates for Red Hat Ansible Automation Platform and Red Hat Enterprise Linux as soon as they become available; restrict change-user permissions to only trusted administrative accounts in the interim.

How to confirm the fix worked

Review user permission assignments and audit logs for unexpected modifications to superuser accounts; retest account privilege changes after applying updates to confirm the flaw is no longer exploitable.

Typical attack path

1. Obtain valid credentials for an account possessing change-user permissions
2. Authenticate to the Ansible Automation Platform web or API interface
3. Craft and submit requests targeting superuser account modification endpoints
4. Verify removal of superuser privileges to confirm successful privilege escalation

How to detect it

Examine authentication and authorization logs for unusual modifications to superuser records originating from non-superuser accounts; correlate with API or UI access patterns around the time of the change.

What your security team should do

• Immediately audit and minimize the number of accounts holding change-user permissions
• Monitor for any Red Hat security advisories addressing this issue and schedule patching
• Implement additional logging and alerting on superuser account modifications