CVE-2026-84499

Name of the Vulnerable Software and Affected Versions Red Hat Ansible Automation Platform automation-controller (affected versions not specified)

Description A flaw exists in the automation-controller where survey questions of type password, which are intended to be write-only and stored encrypted, can be exposed. When a schedule or workflow job template node is revalidated against a tightened survey specification, the controller decrypts the stored password and includes the plaintext value in the minimum/maximum length validation error message returned in the HTTP response. An attacker with the delegated JobTemplate Admin role can exploit this by tightening the survey length constraint and triggering revalidation of a schedule or node created by a higher-privileged user to recover their plaintext password.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.