The flaw allows a user who is an execution‑environment administrator in one organization to associate a container registry credential that belongs to a different organization with an execution environment they control. When the environment runs, the controller decrypts the foreign credential’s registry password and passes it to the container runtime, thereby exposing another organization’s registry credentials across tenant boundaries.

The vulnerability is present in Red Hat Ansible Automation Platform version 2.6 on Red Hat Enterprise Linux 9, affecting the automation‑controller, automation‑controller‑container, and automation‑controller components.

With a CVSS score of 6.8, the exploit is moderate in severity. EPSS data are not available, and the vulnerability is not listed in the KEV catalogue. An attacker requires authenticated execution‑environment admin privileges within one organization and knowledge of a foreign credential’s identifier; no remote code execution or privilege escalation beyond credential leakage is possible. The likely attack vector is an internal threat actor abuse of privileged roles, leading to cross‑tenant credential disclosure.