A flaw in the Ansible Automation Platform automation‑controller allows an attacker to retrieve data that should be hidden by the no_log setting in set_stats artifacts. The WorkflowJobNode.ancestor_artifacts database column accepts arbitrary field lookups through the REST filter backend because it is not wrapped in prevent_search(). Although the column is omitted from the API serializer, the stored data is not masked before being persisted, enabling a logical count oracle that can be used to recover secret values character by character from playbook authors who set no_log, even across organizations.

Red Hat Ansible Automation Platform 2 is the only vendor product listed as affected. No specific version numbers were supplied, so all releases of AAP 2 are likely vulnerable until a patch is released.

The CVSS score of 6.5 indicates moderate risk, and no EPSS score is available, but the vulnerability is not listed in CISA KEV. The attacker can exploit the flaw via the REST API filter endpoint, targeting the ancestor_artifacts column. Any authenticated user with read permissions to a workflow, or even a user with no roles who can perform a regex lookup against the world‑readable credential‑types endpoint, can use the resulting count as a boolean oracle to extract no_log artifacts.