An Ansible Automation Platform flaw allows a user who can only read a credential in a different organization to bind that credential to their own organization. When a project synchronizes, the controller decrypts the credential server‑side and uses the token to authenticate to the owner's Automation Hub, enabling cross‑tenant use of a secret. The vulnerability stems from improper permission verification when attaching Galaxy or Automation Hub credentials, represented by CWE‑863.

Red Hat Ansible Automation Platform version 2.6 running on Enterprise Linux 9. The affected component is the automation‑controller, in particular the galaxy_credentials relationship endpoint. No other product versions are cited as affected.

The CVSS score of 4.1 indicates a low‑severity issue, and the EPSS score is not available; the vulnerability is not listed in CISA’s KEV catalog. However, if an attacker can bind a credential, they can gain access to another organization’s Automation Hub resources by using the decrypted token, which poses a significant confidentiality risk. The attack vector is likely an authenticated API call to the galaxy_credentials endpoint and requires the attacker to have at least read‑only visibility of the target credential.