REDHAT-BUG-2527214: Medium severity Red Hat Automation Controller vulnerability
A flaw was found in the Ansible Automation Platform automation-controller workflow subsystem. WorkflowJobNode.ancestorartifacts (awx/main/models/workflow.py:262-266) is a JSONBlob column that the workflow task-manager fills with the raw merged setstats artifacts of every upstream node's job (geteffectiveartifacts) and, for child workflows, with the parent workflow's aggregated artifacts (seedrootancestorartifacts, workflow.py:743-753). The field is deliberately omitted from WorkflowJobNodeSerializer and Ansible's ansiblenolog flag is honored only after the raw dict has been persisted: in getjobkwargs (workflow.py:352-370) the aggregated artifacts are assigned and saved at lines 360-361, and only afterwards (lines 363-370) are the nolog keys copied into the child job's surveypasswords mask, leaving the ancestorartifacts column itself unredacted. Because the field is not wrapped in preventsearch(), the django-ansible-base FieldLookupBackend admits arbitrary contains/regex/startswith lookups against it. A principal with readrole on the WorkflowJob can issue GET /api/controller/v2/workflowjobnodes/?id=<n>&ancestorartifactscontains=<probe> and use the response count as a boolean oracle to recover the full JSON of the hidden column, including values protected with setstats nolog. In addition, because the credential-types list endpoint is readable by any authenticated user (CredentialTypeAccess.filteredqueryset returns all objects), and because a regular-expression lookup bypasses the JSONField cross-relation guard that rejects icontains, a user with no roles can reach the same column across all organizations via GET /api/controller/v2/credentialtypes/?credentialsworkflowjobnodesancestorartifacts regex=<probe> whenever a workflow node carries a prompted credential. This defeats both the serializer-level omission of the field and Ansible's nolog artifact-masking control, and enables cross-tenant recovery of secrets passed between workflow stages via setstats. This is a variant, on a previously unreported adjacent field, of the earlier Job/JobEvent artifact and stdout preventsearch gaps.
Affected Software
Event History
Frequently Asked Questions
Which users can query the exposed data?
A principal with read_role on a WorkflowJob can query the workflow job nodes endpoint using lookups against the ancestor_artifacts field.
What information may be exposed through the field?
The field stores raw merged set_stats artifacts from every upstream node. For child workflows, it also stores the parent workflow's aggregated artifacts.
Does Ansible's _ansible_no_log flag prevent this exposure?
No. The aggregated artifacts are persisted before no_log keys are copied into the child job's survey_passwords mask, leaving ancestor_artifacts unredacted.
How can the data be queried despite not appearing in the serializer?
The field is omitted from WorkflowJobNodeSerializer, but it is not protected with prevent_search(). The FieldLookupBackend permits __contains, __regex, and __startswith lookups against it, including through the workflow_job_nodes API endpoint.