CVE-2026-84686

{}

{}

{}

{"affected_release": [{"advisory": "RHSA-2026:71113", "cpe": "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "package": "automation-controller-0:4.7.17-1.el9ap", "product_name": "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "release_date": "2026-09-23T00:00:00Z"}], "bugzilla": {"description": "automation-controller: automation-controller-container: automation-controller: notification template password fields can be decrypted by a notification-template administrator by replaying encrypted values across subfields, exposing plaintext Slack, PagerDuty, Twilio, AWS SNS and Grafana credentials", "id": "2527140", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527140"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N", "status": "verified"}, "cwe": "CWE-522", "details": ["A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. Notification template password fields are encrypted with a key\nderived from the secret key, the object primary key, and the field name, but not\nthe subfield name, and the API returns the full ciphertext of a password subfield\nafter the notification type is changed to one that does not define that subfield.\nA user with administrative access to a single notification template, but without\nany wider privilege, can switch the template type to reveal the stored\nciphertext, replant that ciphertext into a webhook password field pointing at a\nserver they control, and trigger a test notification. The controller decrypts the\nreplayed ciphertext to the original plaintext and sends it to the attacker's\nserver in an HTTP Basic authorization header, allowing recovery of Slack,\nPagerDuty, Twilio, AWS SNS, and Grafana credentials the administrator was only\npermitted to use, not read."], "name": "CVE-2026-84686", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-26/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-27/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}], "public_date": "2026-09-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-84686\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84686"], "statement": "This flaw affects automation-controller as shipped in Red Hat Ansible\nAutomation Platform. Exploitation requires an authenticated user with\nadministrative access to a notification template; the impact is recovery of the\nplaintext of notification credentials that the user was only permitted to use.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.6"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "ansible_automation_platform", "vendor": "redhat"}], "created": "2026-09-24T02:45:15.451523+00:00", "updated": "2026-09-27T23:00:13.762587+00:00", "vendors": ["redhat", "redhat$PRODUCT$ansible_automation_platform"]}