Format String Vulnerability in Red Hat Ansible Automation Platform's Automation Controller

CVE-2026-84691

What is CVE-2026-84691?

A vulnerability exists in the Ansible Automation Platform's automation-controller, where an administrator can manipulate a Python format-string template for API 4XX error messages. This template, when rendered with a live user object, allows traversal into application settings, exposing sensitive information such as the Django secret key and database password. The crafted logs can be sent to an external log aggregator, which is also controlled by the administrator, potentially leading to the leakage of critical encryption keys and causing unauthorized access to stored credentials and database services. This flaw emphasizes the importance of proper sanitization and validation of user inputs within logging mechanisms.

References