CVE-2026-84720 Information disclosure in Red Hat Ansible Automation Platform 2.5 for RHEL 8
Authenticated users can recover no_log secrets via ORM traversal count-oracles in Ansible Automation Platform workflow artifacts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-84720?
CVE-2026-84720 is a medium-severity vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8, published on 23 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which stores the raw merged set_stats artifacts propagated between workflow nodes, is not wrapped in prevent_search() and is therefore accepted for arbitrary field lookups by the REST filter backend, even though it is omitted from the API serializer. Because the column is persisted before Ansible's no_log masking is applied, a user with only read access to a workflow — or, via a regular-expression lookup that bypasses the JSON cross-relation filter guard through the world-readable credential-types endpoint, any authenticated user with no roles — can use the result count as a boolean/count oracle to recover, character by character, secret values that a playbook author explicitly marked no_log, including across organizations.
Weakness: CWE-639
Which versions are affected by CVE-2026-84720?
How do I fix CVE-2026-84720?
Apply the vendor's patch.
Is CVE-2026-84720 being exploited?
There is no known exploitation of CVE-2026-84720 in the wild and no public exploit code.
Sources
Also known as GHSA-h789-rmcq-fh7h.