CVE-2026-84691 Red Hat CVE debrief

Who should care

Administrators and users of Red Hat Ansible Automation Platform 2.5 for RHEL 8, 2.5 for RHEL 9, 2.6 for RHEL 9, 2.6, and 2.7 should assess their exposure and take necessary actions to prevent exploitation. Administrators should verify and update their automation-controller installations to prevent exploitation.

Why it matters

CVE-2026-84691 allows an authenticated administrator to obtain sensitive information, including the Django secret key and database credentials, enabling offline decryption of stored credentials and direct access to the controller database.

• Offline decryption of stored credentials
• Direct access to the controller database
• Forgery of user sessions using obtained secrets

Technical summary

The automation-controller in Red Hat Ansible Automation Platform is vulnerable to a format string injection attack. An authenticated administrator can craft a template that walks from the user object into the application settings and reads the Django secret key and the database password. The formatted message is written to a logger that can be forwarded to an external log aggregator, whose destination is also administrator-controlled, allowing the secrets to be sent off the host. Because Python string formatting permits attribute and item traversal on its arguments, an administrator can craft a template that walks from the user object into the application settings and reads the Django secret key and the

Defensive priority

Administrators should verify and update their automation-controller installations to prevent exploitation.

Recommended defensive actions

• Verify and update automation-controller installations to prevent exploitation
• Restrict access to the automation-controller log aggregator
• Monitor for suspicious activity in the controller database
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by an administrator-controlled Python format-string template in the API 4XX error log setting, which can be used to read sensitive information. The setting that formats the log message emitted for API 4XX errors is an administrator-controlled Python format-string template that is rendered with a live user object as an argument. Because Python string formatting permits attribute and item traversal on its arguments, an administrator can craft a template that walks from the user object into the application

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.