CVE-2026-84499 in Ansible Automation Platform
Summary
by MITRE • 09/23/2026
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification, the controller decrypts the stored password and includes its plaintext value in the minimum/maximum length validation error message returned in the HTTP response. A user with the delegated JobTemplate Admin role can tighten the survey length constraint and trigger revalidation of a schedule or node created by another, higher-privileged user, thereby recovering that user's stored password in plaintext.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified within Red Hat Ansible Automation Platform’s automation-controller represents a critical information disclosure flaw rooted in improper handling of sensitive survey data during validation processes. Survey questions designated as type password are inherently write-only and should be stored using strong encryption mechanisms, ensuring that they remain obscured when retrieved or displayed to users. The system is designed such that these values appear only as placeholders on read operations to prevent accidental exposure of credentials. However, the underlying implementation fails to adequately sanitize error messages generated during validation routines, leading to a significant security gap where plaintext secrets can be inadvertently leaked through HTTP response payloads.
The technical mechanism of this flaw involves the revalidation process for schedules or workflow job template nodes. When an administrator with delegated JobTemplate Admin privileges modifies survey specifications by tightening constraints such as minimum or maximum length requirements, the system triggers a validation routine against existing configurations created by other users. During this revalidation step, the automation-controller decrypts the stored password values to perform the necessary checks on string length and format compliance. Crucially, when these validations fail due to non-compliance with the new constraints, the resulting error message returned via HTTP includes the decrypted plaintext value of the password rather than a generic failure indicator or masked representation. This behavior effectively bypasses the encryption safeguards intended for sensitive survey data.
The operational impact of this vulnerability is severe, particularly in multi-tenant environments where privilege separation is enforced through role-based access control models. A user possessing only JobTemplate Admin rights can exploit this flaw to recover passwords belonging to higher-privileged users who created the affected schedules or nodes. By systematically adjusting survey constraints and observing the resulting error responses, an attacker can extract plaintext credentials without needing elevated privileges themselves. This capability undermines the principle of least privilege and allows for potential lateral movement within the infrastructure if those recovered credentials provide access to other systems or services managed by Ansible Automation Platform.
From a classification perspective, this vulnerability aligns with CWE-209: Generation of Error Message Containing Sensitive Information, as it involves the exposure of sensitive data through error messages generated during normal system operations. It also relates to CWE-359: Exposure of Private Personal Information to an Unauthorized Actor, given that passwords are considered private and confidential credentials. In terms of attack patterns, this flaw facilitates unauthorized access by enabling credential harvesting, which can be mapped to the ATT&CK technique T1078: Valid Accounts, specifically under sub-techniques involving harvested credentials for privilege escalation or lateral movement within enterprise networks.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary solution is to apply vendor-provided patches that update the automation-controller software to ensure error messages do not include decrypted sensitive data during validation failures. Administrators should verify their current version against known vulnerable releases and schedule updates accordingly. In addition to patching, organizations should implement strict input validation practices across all application components to prevent similar issues in other modules. Security monitoring tools should be configured to detect anomalous HTTP responses containing potential credential patterns or unusually long error messages that might indicate exploitation attempts. Furthermore, reviewing role assignments is essential; ensuring that JobTemplate Admin privileges are granted only to trusted personnel reduces the attack surface available for this specific vector of privilege escalation and data exfiltration.