CVE-2026-84691

Awaiting Analysis Awaiting Analysis - Queue

Format String Vulnerability in Red Hat Ansible Automation Platform

Publication date: 2026-09-23

Last updated on: 2026-09-24

Assigner: redhat-SADP

Description

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors is an administrator-controlled Python format-string template that is rendered with a live user object as an argument. Because Python string formatting permits attribute and item traversal on its arguments, an administrator can craft a template that walks from the user object into the application settings and reads the Django secret key and the database password. The formatted message is written to a logger that can be forwarded to an external log aggregator, whose destination is also administrator-controlled, allowing the secrets to be sent off the host. An authenticated administrator can thereby obtain the master encryption key used to protect all stored credentials and the database service password, enabling offline decryption of every stored credential, forgery of user sessions, and direct access to the controller database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-24

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-12

NVD

CVE-2026-84691

EUVD

EUVD-2026-85572

Affected Vendors & Products

Vendor	Product	Version / Range
red_hat	ansible_automation_platform	*
red_hat	ansible_automation_platform	From 2.6 (inc)
red_hat	ansible_automation_platform	From 2.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-134	The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Attack-Flow Graph

Executive Summary

This is a format string injection flaw in Red Hat Ansible Automation Platform's automation-controller. An authenticated administrator can craft a malicious Python format-string template in the API's 4XX error log setting. This template can traverse from a user object to access application settings, revealing the Django secret key and database password. These secrets are then logged and may be sent to an external log aggregator controlled by the attacker.

Detection Guidance

Detecting this vulnerability requires checking the automation-controller configuration for insecure log message templates. Review the API 4XX error log settings in the automation-controller configuration files for Python format-string templates that include user object traversal. Look for templates that access application settings or sensitive data. No specific commands are provided in the context, but manual inspection of configuration files and logs is necessary.

Impact Analysis

An attacker with administrator access can obtain the master encryption key, decrypt all stored credentials, forge user sessions, and gain direct access to the controller database. This leads to potential data breaches, unauthorized access to sensitive systems, and full control over the Ansible Automation Platform.

Compliance Impact

This vulnerability can lead to unauthorized access and exposure of sensitive data, violating compliance requirements such as GDPR and HIPAA. It may result in data breaches, unauthorized disclosure of personal or health information, and failure to meet regulatory standards for data protection and access controls.

Mitigation Strategies

Immediately update the automation-controller to the patched versions: Red Hat Ansible Automation Platform 2.6 for RHEL 10 and 9 (RHSA-2026:71113) or 2.5 for RHEL 9 and 8 (RHSA-2026:71114). Review and restrict access to the automation-controller configuration files to prevent unauthorized modifications. Audit log settings to ensure no sensitive data is being logged.

Hi! I’m here to help you understand CVE-2026-84691. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70