CVE-2026-84499 Red Hat — Exploit & Vulnerability Details HIGH

Parameter	Value
CVSS	7.7 (HIGH)
Type	CWE-209 (Information Exposure Through Error Message)
Vendor	Red Hat
Public PoC	No

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification, the controller decrypts the stored password and includes its plaintext value in the minimum/maximum length validation error message returned in the HTTP response.

A user with the delegated JobTemplate Admin role can tighten the survey length constraint and trigger revalidation of a schedule or node created by another, higher-privileged user, thereby recovering that user's stored password in plaintext.

Attack Parameters

Attack Vector

Network

Can be exploited remotely

Attack Complexity

Low

Easy to exploit

Privileges Required

Low

Basic privileges needed

User Interaction

None

No user interaction needed

Impact Assessment

Confidentiality

High

Complete data leak

Integrity

None

No data modification

Availability

None

No disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-209 Information Exposure Through Error Message

Vulnerable Products

red hat:red hat ansible automation platform 2.7 red hat:red hat ansible automation platform 2.6 for rhel 9 red hat:red hat ansible automation platform 2.6 red hat:red hat ansible automation platform 2.5 for rhel 8 red hat:red hat ansible automation platform 2.5 for rhel 9