A template-injection flaw was found in the automation-controller. The controller relies on a single helper, sanitizejinja(), to reject user-supplied Jinja in several fields that are later handed to ansible-core for templating: the module arguments of ad-hoc commands, the username and privilege-escalation fields of Machine credentials, and inventory host names. That helper detects Jinja with two regular expressions whose negated character classes stop at the first interior '}' or '%' character. As a result, a Jinja expression that contains an inner brace — for example "{{ {} or lookup('pipe','id') }}" — is not matched and is accepted, even though it is fully valid Jinja that ansible-core will evaluate at task time. A low-privileged user can therefore inject Jinja that runs inside the execution environment. Two consequences are significant. First, the bypass defeats an administrator who has restricted the allowed ad-hoc modules to non-executing ones (such as ping) to provide "safe" ad-hoc access: a lookup('pipe', ...) embedded in the ping module's arguments executes an arbitrary shell command in the execution environment and returns its output in the job results. Second, the bypass lets a user who administers Machine credentials, but who cannot read another credential (such as a cloud or vault credential), place a lookup('env', ...) expression in a credential field; when both credentials are used together on a job template, the co-attached credential's secret is injected into the execution environment's process environment, templated into the attacker-controlled field, and surfaced in the job output — disclosing the secret across the credential access-control boundary. The underlying weakness is that the guard is an incomplete pattern-based blocklist rather than a real Jinja lexer or an unambiguous rejection of any '{{' or '{%' sequence.

A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification configuration is protected from API filtering, its recipient value is copied in clear text into the unprotected Notification.recipients field on every send. Because the credential-types endpoint is listable by any authenticated user and the API filter backend traverses object relations without per-hop authorization, a user with no privileges can use a relational filter as a boolean count-oracle to recover, character by character and across organizations, the secret recipient values of other tenants' notifications — including PagerDuty service keys and Slack/Mattermost/RocketChat/Webhook bearer-token URLs. This flaw affects confidentiality.

A missing-authorization information-disclosure flaw was found in the automation-controller API. The endpoint GET /api/v2/ping/ (also reachable as /api/controller/v2/ping/) is served by ApiV2PingView with permissionclasses=(AllowAny,) and authenticationclasses=(), making it fully anonymous by design so that the installer and load-balancer health probes can reach it. Beyond the intended liveness fields (high-availability flag and product version), the endpoint's GET handler enumerates every automation-mesh Instance (excluding hop nodes) and every InstanceGroup without any query scoping, and serializes them into the anonymous response. As a result, an unauthenticated remote attacker who can reach the Controller API learns the complete mesh inventory — each node's hostname, node type (control/hybrid/execution), UUID, last heartbeat, capacity, and exact AWX version — together with every instance group's name, capacity, and member hostnames, plus the deployment's install UUID and the active control node identifier. This is data that the authenticated /instances/ and /instancegroups/ endpoints protect behind authentication and role-based access control. Exposing it pre-authentication provides an attacker with detailed internal reconnaissance: it maps the control plane, identifies the highest-value nodes, and reveals exact software versions for targeted exploit selection. No credentials, job data, tenant data, or configuration secrets are exposed, so the confidentiality impact is limited and there is no impact on integrity or availability. The issue is that the endpoint over-serializes RBAC-gated topology into a response that is intentionally unauthenticated; the unauthenticated liveness check itself is expected behavior.

A flaw was found in automation-controller. The JobJobEventsChildrenSummary view does not declare model or parentmodel attributes, causing ModelAccessPermission.checkgetpermissions() to return True for any authenticated user. An attacker with any valid credential can read job event tree structure and eventprocessingfinished status for arbitrary jobs across all organizations, and enumerate valid job IDs platform-wide via the 200/404 response oracle.

An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via automountServiceAccountToken: true, resulting in privilege escalation to a service account.

An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.