CVE-2026-84720

Awaiting Analysis Awaiting Analysis - Queue

Information Disclosure in Ansible Automation Platform

Publication date: 2026-09-23

Last updated on: 2026-09-24

Assigner: redhat-SADP

Description

A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which stores the raw merged set_stats artifacts propagated between workflow nodes, is not wrapped in prevent_search() and is therefore accepted for arbitrary field lookups by the REST filter backend, even though it is omitted from the API serializer. Because the column is persisted before Ansible's no_log masking is applied, a user with only read access to a workflow — or, via a regular-expression lookup that bypasses the JSON cross-relation filter guard through the world-readable credential-types endpoint, any authenticated user with no roles — can use the result count as a boolean/count oracle to recover, character by character, secret values that a playbook author explicitly marked no_log, including across organizations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-24

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-12

NVD

CVE-2026-84720

EUVD

EUVD-2026-85614

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	ansible_automation_platform	*
red_hat	ansible_automation_platform	2.5
red_hat	ansible_automation_platform	2.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-84720 is a flaw in the Ansible Automation Platform's automation-controller workflow subsystem. The WorkflowJobNode.ancestor_artifacts field stores raw merged set_stats artifacts from workflow nodes but lacks the prevent_search() protection. This allows unauthorized users to perform arbitrary database lookups via the REST API, exposing sensitive data marked as no_log. Attackers can recover secrets passed between workflow stages, even across organizations.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized access to the WorkflowJobNode.ancestor_artifacts field in Ansible Automation Platform. Review API logs for unusual field lookups such as __contains or __regex queries targeting this column. Inspect workflow job nodes for unexpected data exposure in responses. Verify no_log masking is applied before persistence in set_stats artifacts.

Impact Analysis

This vulnerability allows low-privileged users, including those with no roles, to exploit response counts to recover secret values marked no_log in playbooks. Attackers can access sensitive data across workflows and organizations, bypassing Ansible's no_log masking. The impact is limited to confidentiality, with a CVSS score of 6.5 (High severity).

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive data, violating compliance requirements under GDPR and HIPAA. GDPR mandates protection of personal data, while HIPAA requires safeguarding protected health information. Unauthorized access to secrets may result in regulatory penalties and loss of trust.

Mitigation Strategies

Apply the latest patches from Red Hat for Ansible Automation Platform 2.5 (RHEL 8/9) or 2.6 (RHEL 9/10) via RHSA-2026:71113 and RHSA-2026:71114. Ensure prevent_search() is applied to WorkflowJobNode.ancestor_artifacts. Review and restrict API access permissions, especially for credential-types endpoints. Monitor for unauthorized workflow queries or data leaks in logs.

Hi! I’m here to help you understand CVE-2026-84720. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70