CVE-2026-84691: Ansible Automation Platform Info Disclosure

CVE-2026-84691 is an information disclosure flaw in Red Hat Ansible Automation Platform that allows administrators to extract sensitive secrets including encryption keys and database passwords through log formatting exploitation. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-84691 Overview

CVE-2026-84691 is a format string vulnerability [CWE-134] in Red Hat Ansible Automation Platform's automation-controller. The flaw resides in the administrator-controlled Python format-string template used to format log messages for API 4XX errors. Because Python string formatting permits attribute and item traversal on its arguments, an authenticated administrator can craft a template that walks from the live user object into application settings. This exposes the Django secret key and the database password. The formatted message is written to a logger that can be forwarded to an administrator-controlled external log aggregator, allowing the secrets to leave the host.

Critical Impact
An authenticated administrator can extract the master encryption key protecting all stored credentials and the database service password, enabling offline decryption of every stored credential, forgery of user sessions, and direct database access.

Affected Products

Red Hat Ansible Automation Platform automation-controller
Red Hat Ansible Automation Platform 2.4
Red Hat Ansible Automation Platform 2.5

Discovery Timeline

2026-09-23 - CVE-2026-84691 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-84691

Vulnerability Analysis

The automation-controller component exposes an administrator-configurable setting that defines the log message template for API 4XX responses. The template is rendered using Python's native string formatting, which supports attribute access ({obj.attr}) and item traversal ({obj[key]}) on any argument passed to format(). The renderer receives a live user object as an argument.

Because Django user objects hold references back into the wider application context, an administrator can traverse from the user object through model relationships and into the Django settings module. Once inside settings, the template can dereference SECRET_KEY and the database connection dictionary containing the service password.

The rendered log message is written to a logger that supports forwarding to an external aggregator whose destination is also administrator-controlled. This chains the disclosure primitive with an exfiltration primitive on the same trust boundary.

Root Cause

The root cause is unsafe use of Python's str.format() on an attacker-influenced template with a rich object graph as the argument. Format strings should be treated as code, not data, when arguments expose sensitive attributes.

Attack Vector

Exploitation requires authenticated administrator access over the network. The attacker updates the 4XX log format setting to include a traversal expression that reaches the Django settings object, then triggers any API request that returns a 4XX response. The secrets are written into the log stream and forwarded to the configured external aggregator, where the attacker retrieves them for offline use.

No verified public exploit code is available. See the Red Hat CVE Record CVE-2026-84691 for authoritative technical details.

Detection Methods for CVE-2026-84691

Indicators of Compromise

Modifications to the API 4XX log message format setting containing attribute traversal syntax such as {user.__class__}, settings, SECRET_KEY, or DATABASES.
Outbound connections from the automation-controller host to newly configured or unfamiliar external log aggregation endpoints.
Log entries from the 4XX handler containing values resembling Django secret keys or database connection strings.

Detection Strategies

Audit automation-controller configuration change history for updates to log format templates and external logging destinations, correlating both changes to the same administrator session.
Alert on any log line emitted by the API 4XX handler that matches high-entropy strings or known secret patterns.
Monitor administrator API activity that updates settings endpoints immediately followed by requests designed to elicit 4XX responses.

Monitoring Recommendations

Forward automation-controller audit logs to a centralized platform and retain configuration change events for correlation.
Baseline the expected external log aggregator destinations and alert on deviations.
Track privileged administrator accounts for anomalous session behavior against the settings API.

How to Mitigate CVE-2026-84691

Immediate Actions Required

Apply the Red Hat security updates referenced in RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71177, and RHSA-2026:71179.
Rotate the Django SECRET_KEY, database service password, and all stored credentials managed by the controller after patching.
Invalidate active user sessions to eliminate any tokens potentially forgeable with a leaked secret key.
Review recent changes to the 4XX log message format and external logging destinations for unauthorized modifications.

Patch Information

Red Hat has published fixes through the advisories listed above. Consult the Red Hat Bug Report #2527151 and the Red Hat CVE Record CVE-2026-84691 for version mapping and update procedures.

Workarounds

Restrict administrator role assignments to the minimum set of trusted operators until patches are applied.
Reset the API 4XX log message format to a static string that does not reference argument attributes.
Remove or lock external log aggregator destinations that are not required for operations.
Monitor and alert on any subsequent modification to logging-related settings.

bash

# Configuration example
# Consult the Red Hat security advisories referenced above for exact patched package versions.