CVE-2026-84713

Awaiting Analysis Awaiting Analysis - Queue

Information Disclosure in Ansible Automation Controller

Publication date: 2026-09-23

Last updated on: 2026-09-24

Assigner: redhat-SADP

Description

A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ configuration is protected from API filtering, its recipient value is copied in clear text into the unprotected Notification.recipients field on every send. Because the credential-types endpoint is listable by any authenticated user and the API filter backend traverses object relations without per-hop authorization, a user with no privileges can use a relational filter as a boolean count-oracle to recover, character by character and across organizations, the secret recipient values of other tenants' notifications — including PagerDuty service keys and Slack/Mattermost/RocketChat/Webhook bearer-token URLs. This flaw affects confidentiality.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-24

Generated

2026-09-25

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-84713

EUVD

EUVD-2026-85610

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	automation-controller	*
pagerduty	pagerduty	*
slack	slack	*
mattermost	mattermost	*
rocketchat	rocketchat	*
webhook	webhook	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an authorization-bypass flaw in the automation-controller's notification subsystem. It allows an attacker with no privileges to recover secret recipient values of other tenants' notifications by exploiting a relational filter as a boolean count-oracle. The flaw occurs because recipient values are copied in clear text from a protected field into an unprotected field during notification sending.

Detection Guidance

This vulnerability involves unauthorized access to notification secrets via API filtering. To detect it, monitor for unusual API requests targeting the credential-types endpoint or notification-related endpoints. Check logs for excessive failed attempts to access or enumerate notification configurations across organizations. Use commands like grep to search logs for patterns such as 'credential-types' or 'Notification.recipients' access attempts.

Impact Analysis

An attacker could gain access to sensitive information such as PagerDuty service keys, Slack/Mattermost/RocketChat/Webhook bearer-token URLs, and other notification credentials. This could lead to unauthorized access to systems, data breaches, or further attacks using the exposed credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations using automation-controller may face compliance violations, data breach notifications, and potential fines due to the exposure of personal or health information.

Mitigation Strategies

Immediately upgrade to a patched version of automation-controller if available. If upgrading is not possible, apply mitigations such as restricting access to the credential-types endpoint and reviewing API filters to ensure proper authorization checks. Disable or restrict relational filters that could be exploited as boolean oracles. Monitor for any signs of exploitation and rotate any exposed secrets like PagerDuty keys or Slack tokens.

Hi! I’m here to help you understand CVE-2026-84713. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70