Ansible automation-controller: REST filter oracle on workflow artifacts leaks no_log secrets across organizations

Impact

The database column holding merged set_stats artifacts passed between workflow nodes is persisted before Ansible applies no_log masking, and the REST filter backend accepts arbitrary field lookups against it even though the serializer hides it. An attacker uses result counts as a boolean oracle to recover secret values character by character. Red Hat states this works for a user with only read access to a workflow, and - through a regex lookup that bypasses the JSON cross-relation filter guard via the world-readable credential-types endpoint - for any authenticated user with no roles at all, including across organization boundaries. For a fleet managed by AAP those secrets are typically the credentials the controller uses to reach GPU nodes, BMCs, registries and cloud APIs, so this is a path from a low-privilege controller account to infrastructure credentials.

Who can reach it

Any authenticated automation-controller API user, including one holding no roles, over the network. No access to the target organization's workflows is required for the credential-types regex path.

What to do

Apply the vendor errata for your AAP stream (RHSA-2026:71113, 71114, 71177, 71179) and restart automation-controller; no node drain is involved. Because the leak is of secrets already stored in the artifacts table, treat any no_log value that passed through a workflow as exposed and rotate it after patching - patching alone does not undo prior disclosure.

References

Related entries

• Airflow Akeyless provider: path-shaped Variable key bypasses the team-scope guard on secret lookupCVE-2026-86465 · Apache Airflow Akeyless provider (secrets backend, team-scope guard)Medium
• Grafana: Viewer-level user crashes the server with a recursive math expressionCVE-2026-88858 · Grafana (server-side expressions math evaluator)Medium
• Jenkins Bitbucket Push and Pull Request Plugin: webhook payload can redirect credentialed requestsCVE-2026-92139 · Jenkins Bitbucket Push and Pull Request Plugin (webhook-supplied URLs)Medium
• Airflow HashiCorp provider: path-shaped Variable key crosses team scope in the Vault secrets backendCVE-2026-97636 · Apache Airflow HashiCorp provider (Vault secrets backend, team-scoped variable lookup)Medium
• Ceph (Python bindings, IMAP4_SSL/SMTP_SSL TLS clients): Ceph's Python code constructs imaplib.IMAP4_SSL andNCVD-2024-010-ceph-python-bindings-imap4-ssl-s · Ceph (Python bindings, IMAP4_SSL/SMTP_SSL TLS clients)Medium
• rclone (serve s3): Path traversal in rclone's S3 gateway lets a caller read and overwrite files above the served root.NCVD-2026-042-rclone-serve-s3 · rclone (serve s3)Medium