The vulnerability exists in the credential type injector validation in Red Hat Ansible Automation Platform. Attacker‑supplied Jinja2 templates are rendered synchronously inside the web worker during credential type creation or update, with no limits on loop depth, output size or execution time. An authenticated superuser can submit a template that consumes excessive CPU and wall‑clock time, causing the worker to hang until the request times out. If enough concurrent requests are issued, all web workers are killed and respawned, making the Controller API and UI unavailable. In some cases, ill‑formed templates produce unhandled exceptions, leading to HTTP 500 responses instead of clean validation errors. The sandboxed rendering environment prevents code execution, so there is no confidentiality or integrity impact – only availability is compromised.

This issue affects Red Hat Ansible Automation Platform version 2.6 running on Enterprise Linux 9, as identified by the CPE cpe:/a:redhat:ansible_automation_platform:2.6::el9. No patch version ranges were specified, so any release built from this code base is potentially vulnerable.

The CVSS score of 4.9 denotes a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, exploitation requires authenticated superuser privileges and the use of the /api/controller/v2/credential_types/ endpoint; the likely attack vector therefore appears to be remote via an authorized API call. The impact is limited to service availability, and the attack requires privileged access, so the overall risk is moderate but can be significant in production deployments where the API is heavily used.