Vulnerability Discussion

Default superuser accounts, such as "root", are considered group authenticators. In the case of Automation Controller this is the "admin" account.

Check

Log in to the Automation Controller web console as an administrator and navigate to Access >> Users.

The only local user allowed is the default/breakglass "admin". All other users need to come from an external authentication source. If any other local users exist, this is a finding.

Fix

Log in to the Automation Controller web console as an administrator and navigate to Access >> Users.

Click the Username to be removed.

Select "Delete" and confirm.