The vulnerability lies in the notification template processing of Red Hat Ansible Automation Platform 2. The Jinja Abstract Syntax Tree whitelist checks only static Getattr nodes, allowing dynamic subscripts such as job['job'+'_env'] and conditional statements like {% if job.id > 100 %}. When such a conditional gating is triggered during job execution, the exception handling mechanism writes the full Python traceback into the notification body. This body is then POSTed to an attacker‑controlled webhook URL, exposing install paths, Python version, and source line numbers. The weakness is a classic information‑exposure flaw, classified as CWE‑209.

Red Hat Ansible Automation Platform 2. No specific affected versions are listed in the advisory. This product is the sole affected vendor/product listed in the advisory.

The vulnerability has a CVSS score of 2.7, indicating low overall risk. EPSS information is not available, and the issue is not currently listed in CISA’s KEV catalog. The attack vector requires an attacker to craft or modify a notification template that contains a dynamic subscript or a conditional gating expression that evaluates to true, and to control the webhook endpoint to receive the leaked traceback. When executed, the reporter will receive environment‑specific details that could assist in further exploitation. Despite its low severity, the information disclosure can support reconnaissance and should be mitigated proactively.