CVE-2026-84691

Executive Summary

CVE-2026-84691 is a format-string injection vulnerability (CWE-134) in the automation-controller component of Red Hat Ansible Automation Platform. An authenticated administrator can supply a malicious Python format-string template for the API 4XX error log message, which is rendered with a live user object as its argument; Python's format-string attribute and item traversal then allows the administrator to read the Django secret key and the database password out of application settings. Successful abuse yields the master encryption key protecting all stored credentials and the database service password, enabling offline decryption of every stored credential, session forgery, and direct database access. The flaw is unpatched across all tracked sources, requires high privilege (PR:H), and carries a CVSS base score of 8.7.

Technical Analysis

The vulnerability class is format-string injection/information disclosure (CWE-134). In Ansible Automation Platform's automation-controller, the setting that controls the format of the log message emitted for API 4XX errors is an administrator-controlled Python format-string template. That template is rendered at runtime with a live user object passed as the formatting argument.

The core defect is that Python's string formatting (str.format) permits attribute and item traversal on its arguments. When an untrusted or administrator-controlled template is allowed to reference arbitrary attributes of the object passed to it, the template author can "walk" from the supplied user object across Python object relationships until reaching sensitive application state. Per the NVD description, an administrator can craft a template that traverses from the user object into the application settings, where it can read:

• The Django secret key (the cryptographic material underpinning session signing and, in this platform, the master encryption key used to protect all stored credentials).
• The database password (the credential used by the controller to reach its backend database).

The resulting formatted message is written to a logger. Critically, the log destination is also administrator-controlled and can be forwarded to an external log aggregator. This turns a local information-disclosure bug into an off-host exfiltration primitive: the rendered string containing the secrets is shipped to an external collector chosen by the administrator, placing the secrets outside the controller host.

Two administrator-controlled settings therefore combine to produce the full impact: the format-string template (the read primitive) and the log-forwarding destination (the exfiltration channel). No memory-corruption, deserialization, or network-facing unauthenticated vector is involved. The attack surface is the administrative configuration interface of the automation-controller and the logging pipeline it feeds.

No public proof-of-concept, exploit code, or Nuclei template exists for this CVE. The precise setting names, configuration keys, and template field identifiers are not disclosed in the available source data, so they are deliberately not specified here. The attack mechanism is fully described at the vulnerability-class level: attribute/item traversal in a Python format string rendered against a privileged object graph.

Because the exploit path requires administrator rights, the CVSS vector reflects PR:H with Scope Changed (S:C), Confidentiality High (C:H), Integrity High (I:H), and Availability None (A:N). The Integrity impact derives from the ability to forge user sessions and directly manipulate or read the controller database once the secret key and database password are recovered.

Exploitation Scenarios

No public PoC available; the attack chain below is inferred from the vulnerability class and the NVD description. No specific function names, endpoints, or parameters are invented.

1. Reconnaissance / target identification. The attacker identifies a reachable Ansible Automation Platform automation-controller instance and confirms they hold or can obtain an account with administrative privileges on it. Note that PR:H means the attacker must already be an authenticated administrator — this is an insider-privilege-abuse or post-compromise-escalation scenario rather than an unauthenticated remote attack. Interim credential theft, a compromised admin session, or a malicious insider satisfies this precondition.

2. Triggering the flaw class. The attacker locates the administrator-controlled setting that defines the log-message format string for API 4XX errors. Because this setting accepts a Python format-string template that is later rendered with a live user object as its argument, the attacker replaces the benign template with one that uses Python's attribute/item traversal syntax (the standard {obj.attr...} / {obj[...]} traversal permitted by str.format) to walk from the user object into the application settings. This is the read primitive. The traversal is not "injected" through user input in the classic sense — it is an abuse of the platform's own templating semantics by a privileged configurator.

3. Payload / execution method at the vulnerability-class level. The crafted template is stored and, on the next API 4XX error event, is rendered against the live user object. During rendering, the format engine resolves the traversal path and substitutes the referenced application-setting values — the Django secret key and the database password — into the produced message text. The attacker does not need to deploy code to the host; the platform renders the payload itself.

4. Exfiltration. The formatted message is written to a logger whose destination is administrator-controlled. By pointing log forwarding at an external log aggregator they control, the attacker causes the rendered secrets to be transmitted off the controller host to a collector they can read.

5. Post-exploitation impact. With the Django secret key in hand, the attacker can forge user sessions (session-signing key compromise) and can attempt to derive the master encryption key protecting all stored credentials, enabling offline decryption of every stored credential in the platform. With the database service password, the attacker gains direct access to the controller database. Together these convert a single configuration abuse into full compromise of stored secrets, authentication integrity, and the controller's data store — as reflected by the C:H and I:H subscores.

Impact Assessment

Business impact is severe for any organization running Ansible Automation Platform as a privileged automation control plane. Ansible controllers typically hold credentials for managed infrastructure — SSH keys, cloud provider secrets, service accounts, and database logins — and those credentials are encrypted at rest using a master key. Recovery of the master encryption key therefore implies potential compromise of every credential the platform manages, not just the controller itself, creating lateral-movement opportunities across the entire automated estate.

Affected systems: the automation-controller component of Red Hat Ansible Automation Platform, and by extension any downstream systems whose credentials are stored in it and any log aggregators configured as forwarding destinations (which may themselves be external SaaS or third-party collectors).

Blast radius drivers, mapped to CVSS subscores:

• AV:N (Network) — the administrative interface and logging pipeline are network-accessible.
• AC:L (Low) — no special conditions beyond the described configuration are required.
• PR:H (High) — attacker must be an authenticated administrator; this constrains the threat actor to insiders, compromised admins, or attackers who first escalate to admin.
• UI:N (None) — no victim interaction required.
• S:C (Changed) — the compromise of the secret key affects components (sessions, stored-credential cryptography, database) beyond the vulnerable component itself.
• C:H — full disclosure of the Django secret key and database password.
• I:H — session forgery and direct database access permit integrity compromise.
• A:N — no availability impact described.

There is no CISA KEV listing, no public PoC, and no evidence of exploit-in-the-wild in the provided data. The realistic exposure is therefore attacker-with-admin-privilege scenarios rather than mass opportunistic exploitation.

Detection Guidance

Sigma Rule

title: Ansible Automation Platform 4XX Log Format Template Tampering (CVE-2026-84691)
id: 9c1f7a2e-3b4d-4e6a-8f21-7d5c9a0b1e42
status: experimental
description: Detects changes to the administrator-controlled API 4XX error log format-string setting on Ansible Automation Platform automation-controller, which can be abused for format-string attribute traversal to disclose the Django secret key and database password.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84691
author: valtersit.com
date: 2026/01/01
logsource:
  product: ansible_automation_platform
  service: automation_controller
detection:
  selection_event:
    event_type:
      - 'configuration_change'
      - 'setting_updated'
      - 'audit'
  selection_setting_keyword:
    setting_name|contains:
      - 'log_format'
      - '4xx'
      - 'error_log'
  selection_template_traversal:
    setting_value|contains:
      - '{settings'
      - '{user.'
      - '__'
      - 'SECRET_KEY'
      - 'DATABASES'
  condition: selection_event and (selection_setting_keyword or selection_template_traversal)
falsepositives:
  - Legitimate administrators editing benign log format strings
level: high
tags:
  - attack.defense_evasion
  - attack.credential_access
  - cve.2026.84691

YARA Rule

rule CVE_2026_84691_Ansible_4xx_Log_Format_Traversal
{
    meta:
        description = "Detects format-string templates abusing Python attribute/item traversal to read Django settings from an Ansible automation-controller 4XX log format setting"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84691"
        cve = "CVE-2026-84691"
        date = "2026-01-01"

    strings:
        $fmt1 = "{settings" ascii wide nocase
        $fmt2 = "{user." ascii wide nocase
        $fmt3 = "{user[" ascii wide nocase
        $kw1  = "SECRET_KEY" ascii wide
        $kw2  = "DATABASES" ascii wide
        $kw3  = "log_format" ascii wide nocase
        $kw4  = "4xx" ascii wide nocase

    condition:
        filesize < 1MB and
        (1 of ($fmt*) and 1 of ($kw1, $kw2)) or
        (2 of ($fmt*) and 1 of ($kw3, $kw4))
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-84691 Ansible Automation Platform potential 4XX log-format secret exfiltration to external aggregator"; flow:established,to_server; content:"SECRET_KEY"; http_client_body; content:"DATABASES"; http_client_body; classtype:attempted-recon; reference:cve,2026-84691; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-84691; sid:202684691; rev:1;)

Elastic Detection

sequence by host.name with maxspan=5m
  [ any where event.action == "setting_changed" and
      (stringContains(to_lower(string(settings.key)), "log") or
       stringContains(to_lower(string(settings.key)), "4xx")) ]
  [ any where event.category == "network" and
      event.type == "connection" and
      (stringContains(string(url.path), "/log") or
       stringContains(to_lower(string(destination.service.name)), "syslog")) ]

Splunk SPL Query

index=ansible_automation_platform (sourcetype=automation_controller OR sourcetype=aap_audit)
| eval kv=lower(coalesce(setting_value, message, _raw))
| where match(kv, "\{settings|\{user\.|\{user\[") OR (match(kv,"log_format|4xx") AND match(kv,"secret_key|databases"))
| stats count min(_time) as first_seen max(_time) as last_seen values(actor_username) as actor by host, setting_name
| where count > 0
| sort - last_seen

Wazuh OSSEC Rule

<group name="ansible_automation_platform,cve-2026-84691,">
  <rule id="100861" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">configuration_change|setting_updated</field>
    <field name="setting_value" type="pcre2">\{settings|\{user\.|\{user\[</field>
    <description>CVE-2026-84691: Ansible automation-controller log format string contains Python attribute traversal - potential secret disclosure</description>
    <mitre>
      <id>T1552.001</id>
      <id>T1078</id>
    </mitre>
  </rule>

  <rule id="100862" level="10">
    <decoded_as>json</decoded_as>
    <field name="setting_name" type="pcre2">log_format|4xx</field>
    <field name="setting_value" type="pcre2">secret_key|databases</field>
    <description>CVE-2026-84691: 4XX log template references sensitive Django settings</description>
    <mitre>
      <id>T1552</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version range is available in the provided data. The following guidance is precautionary and should be validated against the current Red Hat advisory before action.

1. Immediate mitigations (no code patch available):

   • Restrict the set of accounts holding administrator privileges on the automation-controller, and audit those accounts for legitimacy. Because the flaw requires PR:H, tightening admin access is the most direct control.
   • Do not permit arbitrary Python format-string templates to be rendered against live Python objects. Where the platform exposes any setting that formats API 4XX error log messages, restrict modification to a trusted, minimal role and review current values for traversal syntax.
   • Constrain and vet log-forwarding destinations; prevent forwarding to any log aggregator the platform administrator does not need. Log forwarding is part of the exfiltration path — restricting it reduces blast radius.
   • Where feasible, rotate the Django secret key and the database service password if there is any suspicion of abuse, and rotate credential-encryption material only under a controlled, documented procedure.
   • Reduce and monitor outbound log traffic from the controller host; alert on unexpected external log destinations.

2. Patch/upgrade steps:

   • No patch is currently available from tracked sources. Monitor the Red Hat Ansible Automation Platform security advisory feed and the vendor's CVE page for CVE-2026-84691 and apply the fixed release as soon as it is published.
   • Until a fix exists, treat any credential stored in the controller as potentially exposed and plan rotation.

3. Long-term hardening:

   • Apply least-privilege to all configuration interfaces; no single admin setting should be able to leak cryptographic material.
   • Adopt safe string-formatting practices in development: never render administrator- or user-controlled templates against live objects with attribute/item traversal enabled; prefer fixed, non-traversable placeholders.
   • Separate secret material (Django secret key, database password) from objects reachable by templating engines.
   • Enforce centralized audit logging and integrity monitoring of controller configuration changes, and periodically review log-forwarding configuration.

References

• NVD — CVE-2026-84691: https://nvd.nist.gov/vuln/detail/CVE-2026-84691
• Red Hat Ansible Automation Platform security advisories (monitor for CVE-2026-84691): https://access.redhat.com/security/
• CWE-134 — Use of Externally-Controlled Format String: https://cwe.mitre.org/data/definitions/134.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-84691 not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (CVE not yet scored as of report date): https://www.first.org/epss/

No public proof-of-concept, exploit code, or Nuclei template exists for this CVE, and no CISA KEV listing or exploit-in-the-wild evidence was identified in the available data.