The vulnerability is an information disclosure flaw in the automation-controller’s InventorySource.source_vars parameter. Because the prevent_search flag is missing, an attacker can use the credential_types FieldLookupBackend count-oracle function to retrieve inline inventory-plugin credentials that belong to other tenants. This flaw directly exposes sensitive credential data, violating confidentiality. The weakness is classed as CWE-204, indicating an improper handling of data that allows unrestricted data retrieval.

The affected system is the automation-controller product, which implements the InventorySource.source_vars functionality. No specific vendor or version details are provided in the CVE data, so all deployments using this component are potentially impacted.

The CVSS score of 7.7 indicates a high risk of exploitation, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a zero-privilege cross‑tenant operation that could be triggered through the controller’s API or web interface, allowing a non‑privileged user to read credentials of other tenants.