Description
A flaw was found in Red Hat Ansible Automation Platform's automation-controller.
The host_filter query parameter on the hosts list API is parsed into a raw Django
ORM filter whose lookup path is validated only against a sensitive-field blocklist,
with no authorization check on the database relations it traverses. Because job
event and ad-hoc command output fields are not on that blocklist, an authenticated
user holding only the Read role on an inventory can construct filters that traverse
into the output of jobs they have no permission to view and use the returned host
count as a boolean oracle. Using regular-expression lookups, the attacker can
extract, character by character, the output (which routinely contains plaintext
credentials, tokens, and command results) of jobs and ad-hoc commands belonging to
other organizations, resulting in cross-tenant disclosure of job output
Published: n/a
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: Cross-tenant information disclosure via blind extraction of job output
Action: Assess Impact
AI Analysis

Impact

An authenticated user with only a Read role on an inventory can build host_filter queries that traverse a Django ORM model without proper authorization checks. This allows the user to read the output of JobEvent and AdHocCommandEvent objects belonging to other organizations, exposing potentially sensitive credentials and command results. The weakness is identified as CWE-639, indicating an authorization bypass through user-controlled input.

Affected Systems

The vulnerability is present in Red Hat Ansible Automation Platform version 2.6 on Linux Enterprise 9. Users of this platform who interact with the hosts list API are potentially affected.

Risk and Exploitability

The CVSS score is 6.5, indicating a moderate impact. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting that the current exploitation probability may be low but not negligible. The attack requires an authenticated session and the ability to construct arbitrary host_filter queries; it can be carried out by repeatedly querying the API, using regex-based lookups as a boolean oracle to perform character‑by‑character extraction of secret output across tenants.

Generated by OpenCVE AI on September 24, 2026 at 01:38 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest vendor-released patch for Ansible Automation Platform when it becomes available
  • Restrict the Inventory Read role so that only users who truly need access to host data retain it, removing unnecessary permissions that allow host_filter usage
  • Configure API request throttling or pattern monitoring to detect repeated regex-based host_filter queries that may be used for data exfiltration

Generated by OpenCVE AI on September 24, 2026 at 01:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 24 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The host_filter query parameter on the hosts list API is parsed into a raw Django ORM filter whose lookup path is validated only against a sensitive-field blocklist, with no authorization check on the database relations it traverses. Because job event and ad-hoc command output fields are not on that blocklist, an authenticated user holding only the Read role on an inventory can construct filters that traverse into the output of jobs they have no permission to view and use the returned host count as a boolean oracle. Using regular-expression lookups, the attacker can extract, character by character, the output (which routinely contains plaintext credentials, tokens, and command results) of jobs and ad-hoc commands belonging to other organizations, resulting in cross-tenant disclosure of job output
Title automation-controller: automation-controller-container: automation-controller: host_filter SmartFilter ORM traversal exposes JobEvent/AdHocCommandEvent event_data and stdout to users without permission on the job, enabling blind character-by-character extraction of job output (cross-tenant information disclosure)
First Time appeared Redhat
Redhat ansible Automation Platform
Weaknesses CWE-639
CPEs cpe:/a:redhat:ansible_automation_platform:2.6::el9
Vendors & Products Redhat
Redhat ansible Automation Platform
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

threat_severity

Moderate

Subscriptions

Redhat Ansible Automation Platform
cve-icon MITRE

No data.

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-23T00:00:00Z

Links: CVE-2026-84707 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-24T03:00:11Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key