CVE-2026-84499 is a vulnerability in Red Hat Ansible Automation Platform
Published on September 23, 2026
Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplatenode survey min/max validation error message
A flaw was found in Red Hat Ansible Automation Platform's automation-
controller. Survey questions of type password are write-only and stored
encrypted, displayed only as a placeholder on read. When a schedule or
workflow job template node is revalidated against a tightened survey
specification, the controller decrypts the stored password and includes its
plaintext value in the minimum/maximum length validation error message
returned in the HTTP response. A user with the delegated JobTemplate Admin
role can tighten the survey length constraint and trigger revalidation of a
schedule or node created by another, higher-privileged user, thereby
recovering that user's stored password in plaintext.
Vulnerability Analysis
CVE-2026-84499 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Timeline
Reported to Red Hat.
Made public. 22 days later.
Weakness Type
Generation of Error Message Containing Sensitive Information
The software generates an error message that includes sensitive information about its environment, users, or associated data.
Products Associated with CVE-2026-84499
Want to know whenever a new CVE is published for Red Hat Ansible Automation Platform? stack.watch will email you.