CVE-2026-84720 Red Hat CVE debrief

Who should care

Defenders responsible for Red Hat Ansible Automation Platform deployments, especially those with sensitive information managed within the platform, should assess their exposure to this vulnerability. This includes administrators and security teams managing automation workflows and secrets.

Why it matters

CVE-2026-84720 is a medium-severity vulnerability in Red Hat Ansible Automation Platform that allows an authenticated user to recover secret values marked no_log via a count oracle attack. Defenders should prioritize patching and compensating controls for high-risk deployments, and verify their inventory for affected versions.

• Authenticated users can exploit this vulnerability to recover secret values marked no_log.
• The vulnerability allows for a count oracle attack, enabling character-by-character recovery of sensitive information.
• Exploitation requires specific conditions, including access to a workflow and potentially bypassing JSON cross-relation filter guards.
• Defenders need to verify their inventory and apply patches or compensating controls to mitigate potential exposure.

Technical summary

The WorkflowJobNode.ancestor_artifacts database column in Red Hat Ansible Automation Platform is not wrapped in prevent_search(), allowing for arbitrary field lookups via the REST filter backend. This can be exploited by an authenticated user to recover, character by character, secret values marked no_log by a playbook author, potentially across organizations. The vulnerability arises from the column's exposure to REST filter backend lookups, despite being omitted from the API serializer. As a result, an attacker can use the result count as a boolean/count oracle to recover sensitive information. This issue highlights the importance of proper access controls and data protection measures within automation and AI

Defensive priority

Defenders should prioritize verifying their inventory and assessing exposure to this vulnerability. Given the medium CVSS score of 6.5, and the fact that exploitation requires authentication and specific conditions, defenders should focus on patching and compensating controls for high-risk deployments.

Recommended defensive actions

• Verify inventory for affected Red Hat Ansible Automation Platform versions and apply patches or updates as available.
• Implement compensating controls to limit the impact of potential exploitation, such as restricting access to sensitive workflow nodes.
• Monitor for suspicious activity that could indicate attempted exploitation.
• Review and update security configurations to ensure that prevent_search() is properly applied to sensitive database columns.
• Conduct a thorough review of workflow nodes and their access controls to prevent unauthorized access.
• Develop and implement a plan to regularly review and update security configurations for Ansible Automation Platform.
• Engage with security teams to ensure that incident response plans are updated to address potential exploitation of this vulnerability.

Evidence notes

The CVE record and source item provide details on the vulnerability in Red Hat Ansible Automation Platform. The issue is related to the WorkflowJobNode.ancestor_artifacts column and its exposure via the REST filter backend. Red Hat has provided several advisories (RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71177, RHSA-2026:71179) addressing this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.