CVE-2026-84720

Executive Summary

CVE-2026-84720 is an authorization bypass and information-disclosure flaw in the WorkflowJobNode handling of the Ansible Automation Platform automation-controller. The ancestor_artifacts database column stores raw merged set_stats artifacts before no_log masking is applied, and it is not protected by prevent_search(), so the REST filter backend accepts arbitrary field lookups against it even though the serializer omits it from output. An attacker with only read access to a workflow — or, in a second path, any authenticated user with no roles via a regex lookup on the world-readable credential-types endpoint — can use result counts as a boolean/count oracle to recover secrets marked no_log, including across organizations.

Technical Analysis

The vulnerable component is the automation-controller (AWX/Ansible Automation Platform controller) REST API. Two design decisions combine to produce the flaw:

1. Data persisted before masking. set_stats artifacts are merged and written to the WorkflowJobNode.ancestor_artifacts database column before Ansible's no_log masking is applied. Values a playbook author explicitly flagged as secret therefore exist in plaintext in that column.
2. Searchable but invisible field. The column is omitted from the API serializer — it is never returned in responses — but it is not wrapped in prevent_search(). Consequently the REST filter backend accepts arbitrary field lookups against it. The field is effectively write-only from the UI perspective but fully queryable.

Because the field cannot be read directly (it is stripped by the serializer), the attacker cannot simply dump it. Instead, the attack is an oracle attack: the attacker crafts filter queries whose result count leaks one bit of information about the stored secret. By iterating character guesses and observing whether the returned count is non-zero, the secret is recovered character by character.

The NVD description documents two access paths:

• Path A — read access. A user holding only read access to a workflow can issue field lookups against ancestor_artifacts and use the count as an oracle.
• Path B — no roles at all. A regular-expression lookup bypasses the JSON cross-relation filter guard through the world-readable credential-types endpoint. This grants any authenticated user with no roles the same oracle primitive.

Path B is the more severe path: it removes the requirement for any object-level permission, reducing the exploit precondition to "authenticated." The scope is further widened because the leak is cross-organization — code running in one organization can leak artifacts belonging to another.

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (6.5) is consistent: network-reachable, low complexity, low privileges required, no user interaction, high confidentiality impact only, no integrity or availability impact, and no scope change.

No public proof-of-concept, nuclei template, or exploit code is known.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description. It uses only identifiers explicitly named in the source data (WorkflowJobNode.ancestor_artifacts, set_stats, no_log, prevent_search(), credential-types endpoint).

1. Reconnaissance / target identification. The attacker authenticates to the automation-controller REST API — in the worst case (Path B) with an account possessing no roles. They identify workflow jobs (WorkflowJobNode records) whose set_stats output plausibly contains secrets (e.g., workflows that register credentials, tokens, or connection strings as stats). The world-readable credential-types endpoint can be enumerated without special privileges.

2. Triggering the flaw class (authorization bypass via unguarded searchable field). The attacker issues filter lookups against the ancestor_artifacts field, which the REST filter backend accepts because it is not wrapped in prevent_search(). Under Path B, a regular-expression lookup on the credential-types endpoint is used to slip past the JSON cross-relation filter guard.

3. Payload / execution (boolean/count oracle). The serializer never returns ancestor_artifacts, so the attacker cannot read it directly. Instead they submit queries whose matching row count encodes a truth value — for example, a filter that returns ≥1 row only if the stored artifact value matches a guessed prefix. By binary-searching or iterating candidate characters and observing the returned count, the attacker extracts the secret one character at a time. Because the value was written before no_log masking, the plaintext secret is what the oracle tests against.

4. Post-exploitation impact. The attacker reconstructs secrets that the playbook author explicitly marked no_log — including secrets belonging to other organizations. These secrets (credentials, tokens, connection strings) can then be used to pivot into managed infrastructure, additional automation targets, or upstream systems, depending on what the workflow handled.

Impact Assessment

• Confidentiality: High (C:H). The primitive yields character-by-character recovery of plaintext secrets that were supposed to be masked — no integrity or availability impact is claimed by the vector (I:N/A:N).
• Blast radius. The leak is explicitly cross-organization, so a compromise of one low-privilege account can expose secrets belonging to unrelated tenants on the same controller.
• Privilege floor. Path B lowers the requirement to any authenticated user with no roles, making this exploitable by the lowest-privileged authenticated principal — a significant escalation of risk for multi-tenant or self-service deployments.
• Business impact. Automated infrastructure credentials frequently unlock downstream systems (cloud providers, databases, network devices), so disclosure can cascade well beyond the Ansible estate.
• KEV/EPSS. CVE is not in CISA KEV. No EPSS score is available from FIRST.org at time of writing; no exploit code or PoC is public.

Detection Guidance

Sigma Rule

title: Ansible Automation Controller WorkflowJobNode ancestor_artifacts Oracle Probing
id: 9f1c7e42-3b6a-4d21-9a55-cve202684720
status: experimental
description: Detects REST filter queries probing the unguarded WorkflowJobNode.ancestor_artifacts field or regex lookups against credential-types
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84720
author: valtersit.com
logsource:
  product: ansible
  service: automation-controller
detection:
  selection_field:
    http.url|contains:
      - 'ancestor_artifacts'
  selection_endpoint:
    http.url|contains:
      - '/api/v2/credential_types/'
  selection_regex:
    http.url|contains:
      - '__regex'
      - '__search'
  condition: selection_field or (selection_endpoint and selection_regex)
falsepositives:
  - Legitimate administrative tooling that legitimately queries workflow metadata
level: high

YARA Rule

rule CVE_2026_84720_Ansible_Ancestor_Artifacts_Oracle
{
    meta:
        description = "Detects request patterns probing the unguarded ancestor_artifacts field or credential-types regex oracle"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84720"
        date = "2026-01-01"
    strings:
        $field = "ancestor_artifacts" ascii wide nocase
        $ep    = "credential_types" ascii wide nocase
        $rx    = "__regex" ascii wide nocase
        $srch  = "__search" ascii wide nocase
    condition:
        $field or ($ep and any of ($rx, $srch))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84720 Ansible Controller ancestor_artifacts Oracle Probe"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"ancestor_artifacts"; nocase; sid:2026084720; rev:1; reference:cve,2026-84720; classtype:attempted-recon;)
alert http any any -> any any (msg:"CVE-2026-84720 Ansible credential_types regex Oracle Probe"; flow:established,to_server; http.uri; content:"credential_types"; nocase; http.uri; content:"__regex"; nocase; sid:2026084721; rev:1; reference:cve,2026-84720; classtype:attempted-recon;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where url.path : "*ancestor_artifacts*" ]
  [ network where url.path : "*ancestor_artifacts*" ]

This sequences repeated requests targeting the ancestor_artifacts field, characteristic of the character-by-character count-oracle iteration used to extract no_log secrets.

Splunk SPL Query

index=web OR index=proxy
| where match(url, "(?i)ancestor_artifacts") OR (match(url, "(?i)credential_types") AND match(url, "(?i)(__regex|__search)"))
| stats count min(_time) as first_seen max(_time) as last_seen values(url) as urls by src_ip, user
| where count > 20
| sort - count

High request counts against the affected field/endpoint are the primary signal, since legitimate interactive use does not generate large volumes of ancestor_artifacts filter queries.

Wazuh OSSEC Rule

<group name="ansible,cve-2026-84720,">
  <rule id="2026084720" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">ancestor_artifacts</field>
    <description>CVE-2026-84720: Possible oracle probing of unguarded ancestor_artifacts field</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
  <rule id="2026084721" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">credential_types</field>
    <regex>__regex|__search</regex>
    <description>CVE-2026-84720: Possible credential-types regex bypass oracle</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

1. Immediate mitigations. Restrict API access to the automation-controller to trusted administrators; audit and revoke low-privilege/role-less accounts where not strictly required. Because Path A requires only read access to a workflow and Path B requires only authentication, reducing the population of authenticated users materially reduces exposure. Monitor for the detection patterns above while a patch is verified.
2. Patch/upgrade steps. NVD indicates a fix exists but discloses neither the version nor the commit. Obtain the fixed automation-controller release directly from the Ansible Automation Platform vendor advisory and confirm it applies prevent_search() to the WorkflowJobNode.ancestor_artifacts field and closes the credential-types regex-guard bypass. Treat the patch as unconfirmed until independently validated against the fixed build.
3. Long-term hardening. Ensure sensitive fields are masked before persistence rather than relying solely on no_log at serialization time; apply an explicit prevent_search() (or equivalent search-guard) to every column omitted from serializers; and enforce tenant/organization isolation in the filter backend so cross-organization lookups cannot occur regardless of requester role.

References

• NVD — CVE-2026-84720: https://nvd.nist.gov/vuln/detail/CVE-2026-84720
• MITRE CWE-639 (Authorization Bypass Through User-Controlled Key): https://cwe.mitre.org/data/definitions/639.html
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (no score available at time of writing): https://www.first.org/epss/
• No known threat-actor campaigns or in-the-wild exploitation are documented for this CVE in the provided data.