CVE-2026-84720: Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracle
A flaw was found in the Ansible Automation Platform automation-controller workflow subsystem. WorkflowJobNode.ancestorartifacts (awx/main/models/workflow.py:262-266) is a JSONBlob column that the workflow task-manager fills with the raw merged setstats artifacts of every upstream node's job (geteffectiveartifacts) and, for child workflows, with the parent workflow's aggregated artifacts (seedrootancestorartifacts, workflow.py:743-753). The field is deliberately omitted from WorkflowJobNodeSerializer and Ansible's ansiblenolog flag is honored only after the raw dict has been persisted: in getjobkwargs (workflow.py:352-370) the aggregated artifacts are assigned and saved at lines 360-361, and only afterwards (lines 363-370) are the nolog keys copied into the child job's surveypasswords mask, leaving the ancestorartifacts column itself unredacted. Because the field is not wrapped in preventsearch(), the django-ansible-base FieldLookupBackend admits arbitrary contains/regex/startswith lookups against it. A principal with readrole on the WorkflowJob can issue GET /api/controller/v2/workflowjobnodes/?id=<n>&ancestorartifactscontains=<probe> and use the response count as a boolean oracle to recover the full JSON of the hidden column, including values protected with setstats nolog. In addition, because the credential-types list endpoint is readable by any authenticated user (CredentialTypeAccess.filteredqueryset returns all objects), and because a regular-expression lookup bypasses the JSONField cross-relation guard that rejects icontains, a user with no roles can reach the same column across all organizations via GET /api/controller/v2/credentialtypes/?credentialsworkflowjobnodesancestorartifacts regex=<probe> whenever a workflow node carries a prompted credential. This defeats both the serializer-level omission of the field and Ansible's nolog artifact-masking control, and enables cross-tenant recovery of secrets passed between workflow stages via setstats. This is a variant, on a previously unreported adjacent field, of the earlier Job/JobEvent artifact and stdout preventsearch gaps.
Other sources
A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestorartifacts database column, which stores the raw merged setstats artifacts propagated between workflow nodes, is not wrapped in preventsearch() and is therefore accepted for arbitrary field lookups by the REST filter backend, even though it is omitted from the API serializer. Because the column is persisted before Ansible's nolog masking is applied, a user with only read access to a workflow — or, via a regular-expression lookup that bypasses the JSON cross-relation filter guard through the world-readable credential-types endpoint, any authenticated user with no roles — can use the result count as a boolean/count oracle to recover, character by character, secret values that a playbook author explicitly marked nolog, including across organizations.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What level of access is required to exploit this issue?
An attacker needs read_role access on the affected WorkflowJob. No interactive user action is required.
What information could be exposed?
The affected field stores raw merged set_stats artifacts from upstream workflow nodes. For child workflows, it can also contain the parent workflow's aggregated artifacts, including values associated with Ansible no_log processing.
Is the sensitive field returned directly by the API?
No. The field is omitted from the WorkflowJobNode serializer, but unrestricted lookup operations can be used as a count oracle to infer whether attacker-supplied probes match values in the stored artifacts.