CVE-2026-84499 Red Hat CVE debrief

Who should care

Defenders responsible for managing Red Hat Ansible Automation Platform deployments, particularly those with JobTemplate Admin role assignments, should assess exposure and verify configurations.

Why it matters

CVE-2026-84499 allows a user with the delegated JobTemplate Admin role to recover stored passwords in plaintext. Defenders should prioritize verifying and restricting JobTemplate Admin role assignments and ensuring that survey specifications are properly validated.

• Potential exposure of stored passwords in plaintext
• Verification of JobTemplate Admin role assignments and survey specifications is required
• Review and update automation-controller configurations to prevent unauthorized access

Technical summary

The flaw in Red Hat Ansible Automation Platform's automation-controller occurs when survey questions of type password are stored encrypted but displayed as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification, the controller decrypts the stored password and includes its plaintext value in the validation error message. This allows a user with the delegated JobTemplate Admin role to recover stored passwords in plaintext.

Defensive priority

Defenders should prioritize verifying and restricting JobTemplate Admin role assignments and ensuring that survey specifications are properly validated.

Recommended defensive actions

• Verify and restrict JobTemplate Admin role assignments
• Ensure survey specifications are properly validated
• Review and update automation-controller configurations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the flaw, its impact, and affected systems. Red Hat has released errata (RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71177, RHSA-2026:71179) addressing this issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.