CVE-2026-84713 is a vulnerability in Red Hat Ansible Automation Platform
Published on September 23, 2026
Automation-controller: automation-controller: notification.recipients/subject/error lack prevent_search, allowing zero-privilege cross-tenant recovery of notification recipient secrets via filter oracle
A flaw was found in the automation-controller notification
subsystem. Although NotificationTemplate.notification_
configuration is protected from API filtering, its recipient
value is copied in clear text into the unprotected
Notification.recipients field on every send. Because the
credential-types endpoint is listable by any authenticated
user and the API filter backend traverses object relations
without per-hop authorization, a user with no privileges can
use a relational filter as a boolean count-oracle to recover,
character by character and across organizations, the secret
recipient values of other tenants' notifications including
PagerDuty service keys and Slack/Mattermost/RocketChat/Webhook
bearer-token URLs. This flaw affects confidentiality.
Vulnerability Analysis
CVE-2026-84713 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Timeline
Reported to Red Hat.
Made public. 21 days later.
Weakness Type
What is an Insecure Direct Object Reference / IDOR Vulnerability?
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CVE-2026-84713 has been classified to as an Insecure Direct Object Reference / IDOR vulnerability or weakness.
Products Associated with CVE-2026-84713
Want to know whenever a new CVE is published for Red Hat Ansible Automation Platform? stack.watch will email you.