The vulnerability resides in the Thycotic Secret Server external credential plugin of Red Hat Ansible Automation Platform. The plugin accepts a user‑supplied server URL and forwards it to its SDK without checking the scheme, host, or IP range, while the plugin backend runs synchronously in the controller web process. When a credential is tested, a user with only the ‘use’ role can replace the stored URL with any internal address, causing the control plane to issue requests to internal services. Even though the plugin always returns a generic error, the timing differences in the responses reveal whether a host and port are reachable, enabling blind internal network reconnaissance and a request‑forgery attack that can consume web workers and degrade availability.

This flaw affects Red Hat Ansible Automation Platform 2.6 on Red Hat Enterprise Linux 9. The issue lies specifically in the automation controller’s Thycotic Secret Server external credential plugin test endpoint, which is executed inside the controller web process.

The CVSS score of 7.4 indicates a high severity. EPSS is not available, and the flaw is not listed in the CISA KEV catalog. The attack vector is inferred to be a user who holds the ‘use’ role on a credential that employs the plugin; the attacker can invoke the test endpoint to override the server URL. This allows blind server‑side request forgery, internal network reconnaissance via timing analysis, and the consumption of web workers that can affect availability. The lack of input validation makes exploitation straightforward once the required role is present, raising the overall risk.