automation-controller: automation-controller: CredentialType injector validation renders attacker-supplied Jinja2 templates synchronously in the web worker, allowing uncontrolled resource consumption (denial of service) and an unhandled-exception (500) via /api/controller/v2/credential_types/
A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When a custom credential type is created or updated, the injector configuration is validated by rendering each attacker-supplied Jinja2 template synchronously inside the web request worker, with no limit on iteration count, output size, or execution time. An authenticated superuser can submit a credential type whose injector contains deeply nested loops or large string operations, consuming CPU and wall-clock time in the web worker until it is killed by the request timeout; issuing enough concurrent requests places all web workers into a kill-and-respawn loop, making the Controller API and UI unavailable for the duration of the attack. Additionally, certain template constructs raise exception types that the validator does not handle, resulting in an unhandled server error (HTTP 500) instead of a clean validation error. The rendering sandbox prevents code execution, so there is no confidentiality or integrity impact.