← Vulnerability feed

Vulnerability record · CVE-2026-84499 · published 23 September 2026

CVE-2026-84499: Error message information leak vulnerability

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification, the controller decrypts the stored password and includes its plaintext value in the minimum/maximum length validation error message returned in the HTTP response. A user with the delegated JobTemplate Admin role can tighten the survey length constraint and trigger revalidation of a schedule or node created by another, higher-privileged user, thereby recovering that user's stored password in plaintext.

7.7 CVSS 3.1 High EPSS 0.38% · top 70.7% CWE-209 · Error message information leak Awaiting Analysis
7.7CVSS 3.1 base score
0.38%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
6References
26 Sep 2026Last modified by NVD

Description

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification, the controller decrypts the stored password and includes its plaintext value in the minimum/maximum length validation error message returned in the HTTP response. A user with the delegated JobTemplate Admin role can tighten the survey length constraint and trigger revalidation of a schedule or node created by another, higher-privileged user, thereby recovering that user's stored password in plaintext.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

LinkTags
https://access.redhat.com/errata/RHSA-2026:71113
https://access.redhat.com/errata/RHSA-2026:71114
https://access.redhat.com/errata/RHSA-2026:71177
https://access.redhat.com/errata/RHSA-2026:71179
https://access.redhat.com/security/cve/CVE-2026-84499
https://bugzilla.redhat.com/show_bug.cgi?id=2527090

Track CVE-2026-84499 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

4.3CVE-2025-47813Wing FTP Server path disclosure via long UID cookieWing FTP Server before 7.4.4 leaks the full local installation path through loginok.html when a long value is supplied in the UID cookie. The flaw is…KEVEPSS 63%analysed7.5CVE-2024-29059Microsoft .NET Framework error message information disclosureCVE-2024-29059 is an information disclosure flaw in Microsoft .NET Framework, classified as CWE-209 (error message information leak). A remote, unaut…KEVEPSS 99%analysed6.5CVE-2013-7331Microsoft XMLDOM ActiveX control in Internet Explorer leaks local and intranet path informationThe Microsoft.XMLDOM ActiveX control in Internet Explorer on Windows 8.1 and earlier discloses whether local pathnames, UNC share pathnames, intranet…KEVEPSS 50%analysed

Source: NIST National Vulnerability Database (record CVE-2026-84499), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.