The flaw lies in how the Automation Platform handles survey questions of type password. Although such passwords are stored encrypted and shown only as placeholders when read, a revalidation triggered by a schedule or workflow job template node causes the controller to decrypt the stored password. The plaintext value is then included in the minimum/maximum length validation error message returned in the HTTP response, exposing the password to an attacker. The vulnerability is associated with CWE‑209. The impact is the disclosure of a higher‑privileged user’s password, compromising confidentiality and potentially enabling further malicious activity within the organization.

This vulnerability affects only Red Hat Ansible Automation Platform version 2, specifically the automation controller component that manages schedules, workflow job templates, and survey questions. No other vendors or product versions are reported to be impacted.

With a CVSS score of 7.7 the flaw denotes a moderate to high severity. The EPSS value is not available and the vulnerability is not listed in CISA KEV, suggesting lower publicly observed exploitation. The likely attack vector requires an authenticated user with the delegated JobTemplate Admin role to tighten survey limits and trigger revalidation. Although this does not provide remote code execution, it enables plaintext disclosure of a higher‑privileged user's password, which can be a serious incident if the role is misused or compromised. Therefore, systems with this role should treat the issue as a potential insider threat and consider the risk of credential leakage.