CVE-2026-84499
Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplatenode survey min/max validation error message
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification, the controller decrypts the stored password and includes its plaintext value in the minimum/maximum length validation error message returned in the HTTP response. A user with the delegated JobTemplate Admin role can tighten the survey length constraint and trigger revalidation of a schedule or node created by another, higher-privileged user, thereby recovering that user's stored password in plaintext.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplatenode survey min/max validation error message
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification, the controller decrypts the stored password and includes its plaintext value in the minimum/maximum length validation error message returned in the HTTP response. A user with the delegated JobTemplate Admin role can tighten the survey length constraint and trigger revalidation of a schedule or node created by another, higher-privileged user, thereby recovering that user's stored password in plaintext.
- Record
CVE-2026-84499- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-06
EUVDEUVD-2026-85561
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification, the controller decrypts the stored password and includes its plaintext value in the minimum/maximum length validation error message returned in the HTTP response. A user with the delegated JobTemplate Admin role can tighten the survey length constraint and trigger revalidation of a schedule or node created by another, higher-privileged user, thereby recovering that user's stored password in plaintext.
- Record
EUVD-2026-85561- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-fmp7-4cgr-jc56
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey...
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification, the controller decrypts the stored password and includes its plaintext value in the minimum/maximum length validation error message returned in the HTTP response. A user with the delegated JobTemplate Admin role can tighten the survey length constraint and trigger revalidation of a schedule or node created by another, higher-privileged user, thereby recovering that user's stored password in plaintext.
- Record
GHSA-fmp7-4cgr-jc56- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
NVD
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification, the controller decrypts the stored password and includes its plaintext value in the minimum/maximum length validation error message returned in the HTTP response. A user with the delegated JobTemplate Admin role can tighten the survey length constraint and trigger revalidation of a schedule or node created by another, higher-privileged user, thereby recovering that user's stored password in plaintext.
- Record
CVE-2026-84499- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-06
OSVRHSA-2026:71113
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Record
RHSA-2026:71113- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:71114
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Record
RHSA-2026:71114- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
receptorRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el10ap | 0:1.6.8-1.el10ap |
receptorRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:2.6.17-3.el9ap | 0:2.6.17-3.el9ap |
receptorRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
python-sqlparseRed Hat:ansible_automation_platform_developer:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
python3-sqlparseRed Hat:ansible_automation_platform_developer:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
python-sqlparseRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
python3-sqlparseRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
Show 28 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python3.12-sqlparseRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
python3.12-sqlparseRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
automation-platform-uiRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:2.6.14-1.el9ap | 0:2.6.14-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-serverRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-uiRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
python3.12-gitpythonRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:3.1.60-1.el9ap | 0:3.1.60-1.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:4.6.33-1.el8ap | 0:4.6.33-1.el8ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:4.6.33-1.el9ap | 0:4.6.33-1.el9ap |
receptorRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el8ap | 0:1.6.8-1.el8ap |
receptorRed Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el8ap | 0:1.6.8-1.el8ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:2.5.10-8.el8ap | 0:2.5.10-8.el8ap |
receptorRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el8ap | 0:1.6.8-1.el8ap |
receptorRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:2.6.17-3.el9ap | 0:2.6.17-3.el9ap |
receptorRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
python3.12-sqlparseRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 57 CVEs |
before 0:0.6.0-1.el8ap | 0:0.6.0-1.el8ap |
python3.12-sqlparseRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:0.6.0-1.el8ap | 0:0.6.0-1.el8ap |
python3.12-sqlparseRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 57 CVEs |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
python3.12-sqlparseRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
automation-gateway-serverRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:2.5.20260923-1.el8ap | 0:2.5.20260923-1.el8ap |
automation-gateway-serverRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:2.5.20260923-1.el9ap | 0:2.5.20260923-1.el9ap |
python3.12-gitpythonRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:3.1.60-1.el8ap | 0:3.1.60-1.el8ap |
python3.12-gitpythonRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:3.1.60-1.el9ap | 0:3.1.60-1.el9ap |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | CVE List, NVD | |
| facts | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-84499 is a high vulnerability (CVSS 7.7) in Red Hat Ansible Automation Platform 2.5 For Rhel 8, published September 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. No source names a fixed version.
References
access.redhat.com/errata/RHSA-2026:71113
bugzilla.redhat.com/show_bug.cgi?id=2527090
Show 194 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-84499
github.com/advisories/GHSA-fmp7-4cgr-jc56
docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71113.json
cve.org/CVERecord?id=CVE-2026-12564
go.dev/cl/814980
groups.google.com/g/golang-announce/c/94pEornpRlI
pkg.go.dev/vuln/GO-2026-5972
vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module
Left out here: 136 references. The JSON record has them.