An authentication-based vulnerability in Red Hat Ansible Automation Platform allows unauthorized users to recover sensitive, masked credentials from workflow artifacts.

This flaw involves an improper authorization check (CWE-639) within the automation controller where the WorkflowJobNode.ancestor_artifacts database column is exposed to arbitrary field lookups. Any authenticated user can leverage this as a boolean oracle to reconstruct secrets that were intended to be masked by the no_log attribute.

Successful exploitation results in the unauthorized disclosure of sensitive secrets, such as API keys or passwords, which are meant to be protected by Ansible's security features. Although the CVSS score is 6.5, the impact is significant because it allows attackers to bypass core security controls and potentially pivot to other systems using recovered credentials. This vulnerability undermines the integrity of automated workflows and poses a risk to cross-organizational security boundaries.

Immediate Action: Update to the fixed versions specified in the Red Hat security errata (RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71177, or RHSA-2026:71179) depending on your specific platform and release.

Proactive Monitoring: Review audit logs for unusual REST API filter patterns or excessive queries directed at the credential-types endpoint.

Compensating Controls: Restrict access to the Ansible Automation Platform dashboard and API to strictly necessary personnel to minimize the pool of potential attackers who could leverage this oracle.

Public Exploit Available: Unknown

Given the ability to recover sensitive credentials, organizations should prioritize patching their Ansible Automation Platform installations according to the vendor provided guidance. Ensure that all systems are updated to the versions listed in the metadata to close the vulnerability in the REST filter backend.