CVE-2026-84691

Name of the Vulnerable Software and Affected Versions Red Hat Ansible Automation Platform automation-controller (affected versions not specified)

Description A flaw exists in the automation-controller where the log message formatting for API 4XX errors uses an administrator-controlled Python format-string template rendered with a live user object. Due to Python string formatting allowing attribute and item traversal, an authenticated administrator can craft a template to access application settings and retrieve the Django secret key and the database password. These secrets can be forwarded to an external log aggregator. This allows the administrator to obtain the master encryption key for stored credentials and the database service password, enabling offline decryption of credentials, user session forgery, and direct database access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.