CVE-2026-84713

Name of the Vulnerable Software and Affected Versions automation-controller (affected versions not specified)

Description A flaw in the notification subsystem occurs because the recipient value from NotificationTemplate.notification configuration is copied in clear text into the unprotected Notification.recipients field during every send operation. Since the credential-types endpoint is accessible to any authenticated user and the API filter backend lacks per-hop authorization when traversing object relations, an unprivileged user can employ a relational filter as a boolean count-oracle. This allows the recovery of secret recipient values from other tenants, such as PagerDuty service keys and bearer-token URLs for Slack, Mattermost, RocketChat, and Webhooks, impacting confidentiality.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.