{"id":"CVE-2026-84499","aliases":["EUVD-2026-85561","GHSA-fmp7-4cgr-jc56","RHSA-2026:71113","RHSA-2026:71114"],"status":"published","title":"Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplatenode survey min/max validation error message","description":"A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. Survey questions of type password are write-only and stored\nencrypted, displayed only as a placeholder on read. When a schedule or\nworkflow job template node is revalidated against a tightened survey\nspecification, the controller decrypts the stored password and includes its\nplaintext value in the minimum/maximum length validation error message\nreturned in the HTTP response. A user with the delegated JobTemplate Admin\nrole can tighten the survey length constraint and trigger revalidation of a\nschedule or node created by another, higher-privileged user, thereby\nrecovering that user's stored password in plaintext.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00379,"percentile":0.32205,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-209"],"published":"2026-09-23T18:47:54Z","modified":"2026-11-06T01:17:56Z","affected":[{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.17-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el10ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-gateway-proxy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-3.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el10","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el10ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el10","package":"python3-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el10ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el10ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"python3-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el10ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-platform-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.14-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.17-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.17-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.17-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.17-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.17-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.17-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.60-1.el9ap"}]}],"bundled":61},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.33-1.el8ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.33-1.el9ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el8ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el8ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-proxy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.10-8.el8ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el8ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el9ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el9ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-proxy-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.17-3.el9ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.8-1.el9ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el8ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el8ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260923-1.el8ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260923-1.el9ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.60-1.el8ap"}]}],"bundled":57},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.60-1.el9ap"}]}],"bundled":57}],"products":[{"vendor":"red hat","product":"red hat ansible automation platform 2.5 for rhel 8"},{"vendor":"red hat","product":"red hat ansible automation platform 2.5 for rhel 9"},{"vendor":"red hat","product":"red hat ansible automation platform 2.6"},{"vendor":"red hat","product":"red hat ansible automation platform 2.6 for rhel 9"},{"vendor":"red hat","product":"red hat ansible automation platform 2.7"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84499","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527090","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84499","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fmp7-4cgr-jc56"},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484204","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490556","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498122","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508411","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509975","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509976","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510021","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512367","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512368","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512369","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512371","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512372","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512374","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512375","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515827","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515840","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517523","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517527","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517772","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517893","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523205","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527046","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527073","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527085","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527096","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527100","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527112","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527117","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527118","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527123","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527126","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527128","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527139","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527140","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527145","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527151","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527154","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527156","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527187","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527189","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527190","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527191","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527195","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527196","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527198","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527199","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527210","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527211","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527213","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527214","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530744","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71113.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12564","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12564","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12564","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33818","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","tags":["advisory"]},{"url":"https://go.dev/cl/814980","tags":["article"]},{"url":"https://go.dev/issue/80405","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5972","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42504","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42504","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42504","tags":["advisory"]},{"url":"https://go.dev/cl/774481","tags":["article"]},{"url":"https://go.dev/issue/79217","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5038","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54284","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54284","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/939b129e24c0ad5d51368b1aa72fffcaca76f06f","tags":["article"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-pwgv-4x5q-6m9f","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56853","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853","tags":["advisory"]},{"url":"https://go.dev/cl/795540","tags":["article"]},{"url":"https://go.dev/issue/80205","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6089","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56858","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858","tags":["advisory"]},{"url":"https://go.dev/cl/807100","tags":["article"]},{"url":"https://go.dev/issue/80435","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6091","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56859","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56859","tags":["advisory"]},{"url":"https://go.dev/cl/803320","tags":["article"]},{"url":"https://go.dev/issue/80481","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6088","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56860","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","tags":["advisory"]},{"url":"https://go.dev/cl/803681","tags":["article"]},{"url":"https://go.dev/issue/80494","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6218","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56862","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","tags":["advisory"]},{"url":"https://go.dev/cl/804261","tags":["article"]},{"url":"https://go.dev/issue/80528","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6090","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59869","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59869","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59893","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59893","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59893","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/d1d80602741f77ec78e5a04ce4719244cf32352e","tags":["article"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67214","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67214","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67214","tags":["advisory"]},{"url":"https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/5.1.16","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67322","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67322","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-clone-from","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67323","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67323","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67323","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67325","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67325","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67325","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69153","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","tags":["article"]},{"url":"https://github.com/postcss/postcss/releases/tag/8.5.19","tags":["article"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71458","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71458","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71458","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71459","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71459","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71459","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71460","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71460","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71460","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71462","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71462","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71462","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71463","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71463","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71463","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71464","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71464","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71464","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71465","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71465","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71465","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71491","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71491","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71491","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/ef2012a5eeb491e604dea2b00d516904a3830c87","tags":["article"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-f2ff-p2ww-7p4p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73086","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73086","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73086","tags":["advisory"]},{"url":"https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4","tags":["article"]},{"url":"https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3","tags":["article"]},{"url":"https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/3.3.12","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/5.1.11","tags":["article"]},{"url":"https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75838","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75838","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75838","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75884","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75884","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75884","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78679","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78679","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-tagreference-create","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84375","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84375","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/pull/797","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.2","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.2","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84470","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84470","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84470","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84474","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84474","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84474","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84486","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84486","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84486","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84499","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84502","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84502","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84502","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84638","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84638","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84638","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84643","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84643","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84643","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84644","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84644","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84644","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84679","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84679","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84680","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84680","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84680","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84683","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84683","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84683","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84684","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84684","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84684","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84686","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84686","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84686","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84689","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84689","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84689","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84691","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84691","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84691","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84692","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84692","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84692","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84703","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84703","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84703","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84706","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84706","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84706","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84707","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84707","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84707","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84708","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84708","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84708","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84709","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84709","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84709","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84711","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84711","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84711","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84712","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84712","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84712","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84714","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84714","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84714","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84716","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84716","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84716","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84717","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84717","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84717","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84718","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84718","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84718","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84719","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84719","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84719","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84720","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84720","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84720","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84724","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84724","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84724","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87817","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87817","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87817","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87819","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530742","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87819","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87819","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-3.1.60-denial-of-service-via-redos","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527121","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71114.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69152","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69152","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84678","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84678","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84678","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-84499","title":"Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplatenode survey min/max validation error message","description":"A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. Survey questions of type password are write-only and stored\nencrypted, displayed only as a placeholder on read. When a schedule or\nworkflow job template node is revalidated against a tightened survey\nspecification, the controller decrypts the stored password and includes its\nplaintext value in the minimum/maximum length validation error message\nreturned in the HTTP response. A user with the delegated JobTemplate Admin\nrole can tighten the survey length constraint and trigger revalidation of a\nschedule or node created by another, higher-privileged user, thereby\nrecovering that user's stored password in plaintext.","status":"published","published":"2026-09-23T18:47:54.439Z","modified":"2026-11-06T01:06:14.746Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-209"],"updated_at":"2026-11-06T02:55:55.947181Z"}],"euvd":[{"id":"EUVD-2026-85561","description":"A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. Survey questions of type password are write-only and stored\nencrypted, displayed only as a placeholder on read. When a schedule or\nworkflow job template node is revalidated against a tightened survey\nspecification, the controller decrypts the stored password and includes its\nplaintext value in the minimum/maximum length validation error message\nreturned in the HTTP response. A user with the delegated JobTemplate Admin\nrole can tighten the survey length constraint and trigger revalidation of a\nschedule or node created by another, higher-privileged user, thereby\nrecovering that user's stored password in plaintext.","status":"published","published":"2026-09-23T18:47:54Z","modified":"2026-11-06T01:06:14Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-06T02:02:53.341523Z"}],"ghsa":[{"id":"GHSA-fmp7-4cgr-jc56","title":"A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. Survey...","description":"A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. Survey questions of type password are write-only and stored\nencrypted, displayed only as a placeholder on read. When a schedule or\nworkflow job template node is revalidated against a tightened survey\nspecification, the controller decrypts the stored password and includes its\nplaintext value in the minimum/maximum length validation error message\nreturned in the HTTP response. A user with the delegated JobTemplate Admin\nrole can tighten the survey length constraint and trigger revalidation of a\nschedule or node created by another, higher-privileged user, thereby\nrecovering that user's stored password in plaintext.","status":"published","published":"2026-09-23T21:30:41Z","modified":"2026-09-24T09:31:50Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-209"],"updated_at":"2026-11-02T15:12:22.2852Z"}],"nvd":[{"id":"CVE-2026-84499","description":"A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. Survey questions of type password are write-only and stored\nencrypted, displayed only as a placeholder on read. When a schedule or\nworkflow job template node is revalidated against a tightened survey\nspecification, the controller decrypts the stored password and includes its\nplaintext value in the minimum/maximum length validation error message\nreturned in the HTTP response. A user with the delegated JobTemplate Admin\nrole can tighten the survey length constraint and trigger revalidation of a\nschedule or node created by another, higher-privileged user, thereby\nrecovering that user's stored password in plaintext.","status":"published","published":"2026-09-23T19:19:40.233Z","modified":"2026-11-06T01:17:56.293Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-209"],"updated_at":"2026-11-06T06:59:05.647867Z"}],"osv":[{"id":"RHSA-2026:71113","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update","status":"published","published":"2026-09-24T10:15:15Z","modified":"2026-10-20T10:14:50Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:71114","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","status":"published","published":"2026-09-24T10:15:16Z","modified":"2026-10-20T10:14:51Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"}]}}