A high severity format string vulnerability in the Red Hat Ansible Automation Platform controller allows an authenticated administrator to compromise master encryption keys and database credentials.

This flaw involves an administrator-controlled Python format string template used for API 4XX error logs, which can be manipulated to traverse object attributes. An authenticated administrator can leverage this to read sensitive application settings, including the Django secret key and database credentials, and exfiltrate them to external log aggregators.

The compromise of master encryption keys and database passwords poses a critical risk to the confidentiality and integrity of the entire automation infrastructure. An attacker gaining these credentials could decrypt stored secrets, forge user sessions, and gain unauthorized direct access to the underlying controller database. With a CVSS score of 8.7, this vulnerability represents a significant threat to organizational security and compliance.

Immediate Action: Update to the fixed versions as specified in Red Hat Security Advisories RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71177, or RHSA-2026:71179.

Proactive Monitoring: Review audit logs for suspicious modifications to log formatting templates or unusual outbound traffic from log aggregation services.

Compensating Controls: Restrict administrative access to the automation controller to only essential personnel and utilize network segmentation to limit the reach of log forwarding traffic.

Public Exploit Available: No (exploit_available: false)

Given the severity of potential data compromise and the breadth of access granted by the leaked credentials, administrators must prioritize patching the affected Ansible Automation Platform instances. Organizations should move quickly to apply the provided vendor updates to ensure the security of their automation environments.