CVE-2026-84720

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller (affected versions not specified)

Description A flaw exists in the WorkflowJobNode.ancestor artifacts database column, which stores raw merged set stats artifacts propagated between workflow nodes. This column is not wrapped in prevent search(), allowing the REST filter backend to accept arbitrary field lookups despite the column being omitted from the API serializer. Since the data is persisted before no log masking is applied, an attacker with read access to a workflow, or any authenticated user without roles using a regular-expression lookup via the credential-types endpoint, can use the result count as a boolean/count oracle. This allows the character-by-character recovery of secret values explicitly marked as no log by playbook authors, potentially across different organizations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.