CVE-2026-84691: Automation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting discloses django secret_key and database credentials to an administrator
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors is an administrator-controlled Python format-string template that is rendered with a live user object as an argument. Because Python string formatting permits attribute and item traversal on its arguments, an administrator can craft a template that walks from the user object into the application settings and reads the Django secret key and the database password. The formatted message is written to a logger that can be forwarded to an external log aggregator, whose destination is also administrator-controlled, allowing the secrets to be sent off the host. An authenticated administrator can thereby obtain the master encryption key used to protect all stored credentials and the database service password, enabling offline decryption of every stored credential, forgery of user sessions, and direct access to the controller database.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated automation-controller administrator can exploit it. The attacker needs permission to control the API 4XX error-log formatting setting and, to exfiltrate the resulting output, access to an administrator-controlled external log aggregation destination.
What secrets can be exposed, and what is the impact?
The crafted format string can disclose the Django secret key and the database password. This can enable offline decryption of stored credentials, forgery of user sessions, and direct access to the controller database.
How would an administrator determine whether the issue may have been exploited?
Review the configured API 4XX error-log format template for attribute or item traversal intended to access application settings, and inspect log-forwarding configuration and destination logs for unexpected secret-like values. The vulnerable formatting output is written to a logger that may be forwarded to an externally controlled aggregator.
What can be done if patching is not immediately possible?
Restrict administrator access, review and remove untrusted API 4XX log-format templates, and disable or tightly control forwarding of the affected logger to external aggregators. If exposure is suspected, treat the Django secret key, database password, and stored credentials as compromised and rotate them as appropriate.