CVE-2026-84707

{}

{}

{}

{"affected_release": [{"advisory": "RHSA-2026:71113", "cpe": "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "package": "automation-controller-0:4.7.17-1.el9ap", "product_name": "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "release_date": "2026-09-23T00:00:00Z"}], "bugzilla": {"description": "automation-controller: automation-controller-container: automation-controller: host_filter SmartFilter ORM traversal exposes JobEvent/AdHocCommandEvent event_data and stdout to users without permission on the job, enabling blind character-by-character extraction of job output (cross-tenant information disclosure)", "id": "2527189", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527189"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "verified"}, "cwe": "CWE-639", "details": ["A flaw was found in Red Hat Ansible Automation Platform's automation-controller.\nThe host_filter query parameter on the hosts list API is parsed into a raw Django\nORM filter whose lookup path is validated only against a sensitive-field blocklist,\nwith no authorization check on the database relations it traverses. Because job\nevent and ad-hoc command output fields are not on that blocklist, an authenticated\nuser holding only the Read role on an inventory can construct filters that traverse\ninto the output of jobs they have no permission to view and use the returned host\ncount as a boolean oracle. Using regular-expression lookups, the attacker can\nextract, character by character, the output (which routinely contains plaintext\ncredentials, tokens, and command results) of jobs and ad-hoc commands belonging to\nother organizations, resulting in cross-tenant disclosure of job output"], "name": "CVE-2026-84707", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-26/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-27/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}], "public_date": "2026-09-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-84707\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84707"], "statement": "This flaw affects automation-controller as shipped in Red Hat Ansible Automation\nPlatform. Exploitation requires an authenticated user with at least the Read role\non one inventory whose hosts have been targeted by jobs; the impact is disclosure\nof job and ad-hoc command output -- which may contain plaintext secrets -- for jobs\nthe user has no permission to view, including across organizations, without any\nability to modify data. Cross-organization disclosure of tenant data is a tenancy\ncrossing under a single controller authorization authority and does not change the\nCVSS scope. Red Hat recommends both marking event_data and stdout as\nnon-searchable and restricting host_filter to an allow-list of host-local fields\nrather than permitting open ORM relation traversal.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.6"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "ansible_automation_platform", "vendor": "redhat"}], "created": "2026-09-24T01:45:13.237065+00:00", "updated": "2026-09-24T03:00:11.116874+00:00", "vendors": ["redhat", "redhat$PRODUCT$ansible_automation_platform"]}