The vulnerability allows an administrator who can manage a single notification template to exploit asymmetric encryption of password fields. The field encryption key is derived from the wrapper secret, object primary key, and field name only, omitting the subfield name. A template type change can expose the full ciphertext of a password subfield. The attacker can then replay that ciphertext into a webhook password field of a different notification type and trigger a test notification. The system decodes the replayed ciphertext and sends the original plaintext credentials to the attacker’s server. The exposed credentials include Slack, PagerDuty, Twilio, AWS SNS, and Grafana secrets, which the administrator was only authorized to use, not view. This results in the compromise of sensitive service credentials but does not grant direct execution on the host.

Red Hat Ansible Automation Platform version 2.6 for Enterprise Linux 9. The flaw resides in the automation-controller component handling notification templates.

The flaw has a CVSS score of 7.6, indicating high severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local privileged access: a user with template‑administration rights can manipulate the notification type to extract ciphertext, then externally trigger a notification to exfiltrate credentials. Without an immediate patch, organizations risk exposure of multiple third‑party service credentials.