Ansible automation-controller: log format template reads the Django secret key and DB password

Impact

The administrator-controlled template that formats log messages for API 4XX errors is rendered as a Python format string with a live user object as its argument, and Python formatting allows attribute and item traversal. A template can walk from that object into application settings and read the Django secret key and the database password, and the formatted line goes to a logger whose external aggregator destination is also administrator-controlled - so the secrets leave the host. The secret key is the master key protecting every stored credential, which means offline decryption of all of them plus session forgery and direct database access. Where automation-controller drives a GPU fleet, those stored credentials are typically the fleet's BMC logins, SSH keys, cloud and registry tokens: a controller compromise becomes fleet compromise, and remediation is credential rotation across every node rather than a single patch.

Who can reach it

Network, authenticated as an automation-controller administrator (the CVSS vector requires high privileges). It is a privilege-boundary break - an admin of the controller UI extracts the encryption key and database password that the platform is meant to keep from them - and the exfiltration path is the existing external log forwarder.

What to do

Apply the Red Hat errata for your release: RHSA-2026:71113 / 71114 / 71177 / 71179 cover Ansible Automation Platform 2.5 and 2.6 on RHEL 8 and 9. Package update and a controller service restart; no GPU node disruption. Because the key and database password may already be out via the log aggregator, rotate the Django secret key, the controller database password and every credential stored in the controller, and review the log-aggregator destination and the 4XX log template for tampering.

References

Related entries

• GitLab: stored XSS through merge request diff paths runs script in another user's sessionCVE-2026-84739 · GitLab CE/EE merge request diff viewer (path component sanitization)High
• Citrix NetScaler ADC/Gateway: Unauthenticated remote denial of service, actively exploitedCVE-2026-88779 · Citrix NetScaler ADC/GatewayHigh
• GitLab CE/EE: stored XSS via crafted repository content in syntax-highlighted outputCVE-2026-92883 · GitLab CE/EE (syntax-highlighted blob rendering, HTML attribute sanitization)High
• HPE iLO3/4/5: Remote unauthenticated denial of service against the management controllerCVE-2018-7093 · HPE iLO3/4/5High
• NAKIVO Backup & Replication: Unauthenticated absolute path traversal via getImageByPathCVE-2024-48248 · NAKIVO Backup & ReplicationHigh
• Socomec DIRIS Digiware M-70 1.6.9 (Modbus TCP and Modbus RTU-over-TCP): A large cluster of unauthenticated ModbusCVE-2024-48882 · Socomec DIRIS Digiware M-70 1.6.9 (Modbus TCP and Modbus RTU-over-TCP)High