Is CVE-2026-84720 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84720 being exploited in the wild.

How severe is CVE-2026-84720?

Medium severity, with a CVSS score of 6.5, published 23 September 2026.

Is there a fix for CVE-2026-84720?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-84720 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-84720?

Check whether you run Red Hat Ansible Automation Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84720: Red Hat Ansible Automation Platform controller information disclosure via database column filtering

CVE-2026-84720 · Severity: medium · CVSS 6.5 · Published 2026-09-23

The Ansible Automation Platform's automation-controller has a database column containing sensitive workflow artifacts that is exposed to REST API searches without proper restrictions. An authenticated user with minimal privileges can exploit this to gradually extract secrets that playbook authors explicitly marked as hidden, including credentials and sensitive data stored across different organizations through carefully crafted queries.

Technologies: Red Hat Ansible Automation Platform. Vendors: Red Hat.

Quick answers

Is CVE-2026-84720 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84720 being exploited in the wild.
How severe is CVE-2026-84720?: Medium severity, with a CVSS score of 6.5, published 23 September 2026.
Which products and versions are affected?: Red Hat Ansible Automation Platform <UNKNOWN>.
Is there a fix for CVE-2026-84720?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-84720 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-84720?: Check whether you run Red Hat Ansible Automation Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The WorkflowJobNode.ancestor_artifacts database column lacks prevent_search() protection and is searchable via REST filter backends despite being omitted from the API serializer. The column contains raw merged set_stats artifacts with no_log masking applied before persistence, allowing authenticated attackers to use result counts as a boolean oracle to recover secret values character-by-character via REST API lookups or regex-based queries against the world-readable credential-types endpoint.

Affected products

Red Hat Ansible Automation Platform <UNKNOWN>

Timeline

2026-09-23: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.