CVE-2026-84720

Description

A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which stores the raw merged set_stats artifacts propagated between workflow nodes, is not wrapped in prevent_search() and is therefore accepted for arbitrary field lookups by the REST filter backend, even though it is omitted from the API serializer. Because the column is persisted before Ansible's no_log masking is applied, a user with only read access to a workflow — or, via a regular-expression lookup that bypasses the JSON cross-relation filter guard through the world-readable credential-types endpoint, any authenticated user with no roles — can use the result count as a boolean/count oracle to recover, character by character, secret values that a playbook author explicitly marked no_log, including across organizations.

Traduire en français

Produits concernés

• Red Hat Ansible Automation Platform 2.5 for RHEL 8
• Red Hat Ansible Automation Platform 2.5 for RHEL 9
• Red Hat Ansible Automation Platform 2.6 for RHEL 9
• Red Hat Ansible Automation Platform 2.6
• Red Hat Ansible Automation Platform 2.7

Scores CVSS

Faiblesses (CWE)

• CWE-639

Références

• https://access.redhat.com/errata/RHSA-2026:71113
• https://access.redhat.com/errata/RHSA-2026:71114
• https://access.redhat.com/errata/RHSA-2026:71177
• https://access.redhat.com/errata/RHSA-2026:71179
• https://access.redhat.com/security/cve/CVE-2026-84720
• https://bugzilla.redhat.com/show_bug.cgi?id=2527214

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories