CVE-2026-84499

Executive Summary

CVE-2026-84499 is an information-disclosure flaw in Red Hat Ansible Automation Platform's automation-controller component, affecting survey questions of type "password" used by schedule and workflow job template nodes. When such a node is revalidated against a tightened survey specification, the controller decrypts the stored password and embeds its plaintext value in the minimum/maximum length validation error returned in the HTTP response, exposing a credential that is designed to be write-only. A user holding the delegated JobTemplate Admin role can tighten a survey length constraint and trigger revalidation of a schedule or node created by another, higher-privileged user, recovering that user's stored password in plaintext. The impact is high confidentiality loss confined to stored survey passwords, with a CVSS base score of 7.7 (scope-changed, no integrity or availability impact).

Technical Analysis

The vulnerability resides in the automation-controller's handling of encrypted survey credentials and its validation error rendering path. Survey specifications in Ansible Automation Platform can include questions of type "password." By design, these are write-only: the value is stored encrypted, and when the survey definition is read back through the UI or API, the field is displayed only as a placeholder rather than the stored value.

The flaw arises during revalidation. When a schedule or a workflow job template node is revalidated against a survey specification, the controller must check whether the stored survey data still satisfies the (possibly changed) specification — including minimum and maximum length constraints. For password-type questions, the controller decrypts the stored password in order to perform this length check. When the stored value fails the length constraint, the generated validation error message is constructed in a way that includes the plaintext password value rather than a sanitized or redacted representation. That error message is then returned to the caller in the HTTP response body.

This is a classic CWE-209 (Generation of Error Message Containing Sensitive Information) pattern: secret material handled during a privileged server-side comparison is leaked because the error path fails to redact it. The confidentiality boundary that normally protects password surveys — encryption at rest plus placeholder-only read — is bypassed entirely on the write/validation path.

The privilege model compounds the issue. The attacker does not need global administrative rights; the delegated JobTemplate Admin role is sufficient to alter the survey length constraint on a template. Revalidation then causes the controller to decrypt and echo a password that belongs to a different, higher-privileged user's schedule or node. The victim user need not take any action, and no user interaction is required at exploitation time (UI:N). The scope change (S:C) reflects that the vulnerable component's privilege boundary is crossed: a lower-privileged delegated administrator obtains a credential stored by and intended for a more privileged principal.

Attack surface: the automation-controller web/API interface (AV:N), reachable over the network with authenticated low privileges (PR:L). The CVSS vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N yields 7.7, reflecting a low-complexity, high-confidentiality disclosure with no integrity or availability effect.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template exists for this CVE. The attack chain below is inferred strictly from the vulnerability class described in the NVD entry; no specific endpoint paths, parameter names, or function names are asserted because the description does not disclose them.

1. Reconnaissance / target identification. The attacker must first possess an authenticated account on the automation-controller with the delegated JobTemplate Admin role. They enumerate job templates that include password-type survey questions, and identify schedules or workflow job template nodes created by another user — ideally a higher-privileged user whose stored survey password is worth recovering. The relevant artifacts (surveys, schedules, workflow job template nodes) are all named in the description.

2. Triggering the flaw class. The attacker tightens the survey length constraint — for example, narrowing the permitted minimum/maximum length of a password-type question — on the target template. This causes the schedule or workflow job template node to be revalidated against the tightened survey specification.

3. Execution / leak retrieval. During revalidation, the controller decrypts the stored password to check it against the new length bounds. Because the stored value now violates the tightened constraint, the length validation fails and the controller emits a minimum/maximum length validation error. That error message contains the decrypted password in plaintext and is returned in the HTTP response. The attacker simply reads the response body to recover the credential. No payload, injection string, or code execution is involved — the leak is a direct consequence of the error-generation path.

4. Post-exploitation impact. The recovered plaintext password can be reused against the systems or services that the survey question was intended to authenticate to, or against any resource where the higher-privileged user's credential is valid. Because the disclosure crosses user boundaries (from a delegated JobTemplate Admin to a higher-privileged schedule/node owner), it enables horizontal and potentially vertical privilege escalation via credential reuse. The attacker may also repeat the technique across multiple templates to harvest credentials at scale.

Impact Assessment

Business impact centers on credential compromise rather than service disruption. Recovered survey passwords are, by their purpose, credentials for downstream systems — automation targets, external services, or API integrations — so their disclosure can compromise systems well outside the automation-controller itself, increasing blast radius beyond the direct host.

CVSS subscores:

• Confidentiality (C:H): the plaintext value of a deliberately write-only, encrypted credential is fully disclosed.
• Integrity (I:N) and Availability (A:N): no data is modified and no service is degraded.
• Attack Vector (AV:N): exploitation occurs over the network via the controller's web/API interface.
• Attack Complexity (AC:L): no special conditions; revalidation is a normal controller operation.
• Privileges Required (PR:L): only the delegated JobTemplate Admin role is needed.
• User Interaction (UI:N): the victim need not perform any action.
• Scope (S:C): the attacker crosses a privilege boundary, obtaining a credential belonging to a more privileged principal.

Affected systems are Red Hat Ansible Automation Platform deployments running a vulnerable automation-controller, specifically those using password-type survey questions with length constraints on schedules or workflow job template nodes. Multi-tenant deployments that delegate the JobTemplate Admin role to less-trusted operators are at elevated risk, since the technique directly abuses that delegated privilege. Because the flaw is unpatched and no public exploitation has been observed, the current likelihood of mass exploitation is lower, but the low complexity and the high value of the leaked credentials make targeted abuse realistic for an insider or a compromised low-privilege account.

Detection Guidance

Sigma Rule

title: Ansible Automation Controller Survey Password Leak via Validation Error
id: 8f3c1a2e-6b47-4d9a-9c2f-ansible84499
status: experimental
description: Detects HTTP responses from the automation-controller that return a survey length validation error potentially containing a decrypted password value.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84499
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'PATCH'
  selection_endpoint:
    cs-uri-stem|contains:
      - 'survey'
      - 'schedules'
      - 'workflow_job_template_nodes'
  selection_error:
    sc-status: 400
    response_body|contains:
      - 'min_length'
      - 'max_length'
      - 'minimum'
      - 'maximum'
  selection_password_kw:
    response_body|contains: 'password'
  condition: selection_method and selection_endpoint and selection_error and selection_password_kw
falsepositives:
  - Legitimate survey validation errors that do not contain secrets
level: high

YARA Rule

rule CVE_2026_84499_Survey_Password_Leak
{
    meta:
        description = "Detects automation-controller HTTP response bodies leaking decrypted survey password values in length validation errors"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84499"
        date = "2026-01-01"
        severity = "high"

    strings:
        $err_min = "min_length" ascii wide nocase
        $err_max = "max_length" ascii wide nocase
        $err_min2 = "minimum length" ascii wide nocase
        $err_max2 = "maximum length" ascii wide nocase
        $pw = "password" ascii wide nocase
        $survey = "survey" ascii wide nocase

    condition:
        (uint16(0) == 0x0A0D or true) and
        $pw and $survey and
        (1 of ($err_min, $err_min2)) and
        (1 of ($err_max, $err_max2))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84499 Ansible Automation Controller Survey Password Disclosure in Validation Error"; flow:established,to_client; http.method; content:"POST"; http.response_body; content:"min_length"; http.response_body; content:"password"; http.response_body; content:"max_length"; nocase; reference:cve,2026-84499; classtype:attempted-recon; sid:202684499; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=30s
  [http where http.request.method in ("POST","PUT","PATCH") and
   url.path contains ("survey" or "schedules" or "workflow_job_template_nodes")]
  [http where http.response.status_code == 400 and
   http.response.body contains "password" and
   (http.response.body contains "min_length" or http.response.body contains "max_length")]

Splunk SPL Query

index=web OR index=proxy
| search (uri_path="*/survey*" OR uri_path="*/schedules*" OR uri_path="*/workflow_job_template_nodes*")
| search (status=400 OR status_code=400)
| search (response_body="*password*" AND (response_body="*min_length*" OR response_body="*max_length*" OR response_body="*minimum length*" OR response_body="*maximum length*"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri_path, status
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,ansible,automation-controller,">
  <rule id="844990" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">/survey|/schedules|/workflow_job_template_nodes</field>
    <field name="status">400</field>
    <description>CVE-2026-84499: Possible Ansible automation-controller survey password disclosure in length validation error response</description>
    <mitre>
      <id>T1552</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source; no vendor fix or workaround is currently published.

1. Immediate mitigations

• Restrict and audit assignment of the delegated JobTemplate Admin role. Limit it to fully trusted operators, since the exploit requires only this delegated privilege.
• Where possible, avoid password-type survey questions on schedules and workflow job template nodes, or avoid tightening their length constraints, which is the action that triggers revalidation and the leak.
• Monitor HTTP responses from the automation-controller for validation errors containing password material (see Detection Guidance), and treat any such occurrence as a potential credential compromise.
• If a leak is suspected, rotate every credential stored in affected survey questions, prioritizing those owned by higher-privileged users.

2. Patch / upgrade steps

• There is currently no patch. Track Red Hat's advisories for Ansible Automation Platform and automation-controller for the CVE-2026-84499 fix, and apply it as soon as it becomes available. Do not treat any version as fixed until Red Hat publishes a corresponding errata.

3. Long-term hardening

• Enforce least privilege on delegated administrative roles and review role assignments regularly.
• Adopt a policy that secret material is never interpolated into user-facing messages or error strings; redact or reference secrets by placeholder only.
• Restrict network access to the automation-controller web/API interface to trusted administrative networks.
• Rotate secrets on a defined schedule and centralize credential management to reduce the lifetime and value of any single leaked secret.

References

• NVD — CVE-2026-84499: https://nvd.nist.gov/vuln/detail/CVE-2026-84499
• CWE-209 — Generation of Error Message Containing Sensitive Information: https://cwe.mitre.org/data/definitions/209.html
• Red Hat Ansible Automation Platform product and security advisory portal: https://access.redhat.com/security/
• MITRE ATT&CK — T1552 Unsecured Credentials: https://attack.mitre.org/techniques/T1552/

No exploit-in-the-wild evidence, public PoC, or threat actor campaign has been observed or reported for CVE-2026-84499 at the time of writing. CISA KEV status: NOT listed.