CVE-2026-84713 Red Hat CVE debrief

Who should care

Defenders responsible for Red Hat Ansible Automation Platform 2.7 deployments, especially those using the automation-controller notification subsystem, should assess exposure and implement compensating controls to protect sensitive notification recipients.

Why it matters

CVE-2026-84713 allows an authenticated user with no privileges to recover secret recipient values of other tenants' notifications in Red Hat Ansible Automation Platform 2.7, affecting confidentiality. Defenders should verify exposure, implement compensating controls, and monitor notification logs.

• Verification of exposure and potential unauthorized access to sensitive notification recipient values.
• Implementation of compensating controls to protect sensitive information.
• Monitoring notification logs for suspicious activity.
• Remediation priority for affected Red Hat Ansible Automation Platform 2.7 deployments.

Technical summary

The automation-controller notification subsystem flaw allows an authenticated user with no privileges to use a relational filter as a boolean count-oracle to recover secret recipient values of other tenants' notifications, including PagerDuty service keys and Slack/Mattermost/RocketChat/Webhook bearer-token URLs. This occurs because the credential-types endpoint is listable by any authenticated user and the API filter backend traverses object relations without per-hop authorization. As a result, an attacker can recover character by character and across organizations, the secret recipient values of other tenants' notifications.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls to protect sensitive notification recipients, especially in environments where notifications may contain sensitive information.

Recommended defensive actions

• Verify exposure by checking if the automation-controller notification subsystem is in use and if sensitive information is being sent through notifications.
• Implement compensating controls, such as restricting access to notification recipient values and using secure notification channels.
• Monitor notification logs for suspicious activity and implement additional security measures to prevent unauthorized access.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the flaw, its impact on confidentiality, and affected products. However, specific versions and remediation steps require verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.