Advisory · CVE-2026-84691
Format string flaw leaks AAP master secrets through log settings
An administrator-controlled log message template in automation controller is rendered with a live user object, allowing format string traversal that reads the Django secret key and database password into forwardable logs.
- Vendor
- Red Hat
- Product
- Red Hat Ansible Automation Platform 2
- Identifier / CWE
- CVE-2026-84691
CWE-134 - Action timing
- Immediate
Explain it like I’m five
The system lets bosses write their own fill-in-the-blank log messages, but the blanks can ask for anything, including the master keys. The filled-in message then gets mailed to whatever log server the boss chose.
- 01Template control
An authenticated administrator sets the Python format-string template used for API 4XX error log messages.
- 02Traversal
Python string formatting permits attribute and item traversal, so the template walks from the live user object into application settings.
- 03Secret capture
The rendered message contains the Django secret key and the database password.
- 04Exfiltration
The message is written to a logger that can be forwarded to an external, administrator-controlled log aggregator, sending the secrets off the host.
What happened
The setting that formats log messages for API 4XX errors in automation controller is an administrator-controlled Python format-string template rendered with a live user object as an argument. Because Python string formatting allows attribute and item traversal on its arguments, an administrator can craft a template that walks from the user object into application settings and reads the Django secret key and the database password. The formatted message goes to a logger that can be forwarded to an external log aggregator whose destination is also administrator-controlled.
Possession of the master encryption key enables offline decryption of every stored credential, forgery of user sessions, and direct access to the controller database. Red Hat reports Red Hat Ansible Automation Platform 2 as affected and rates the issue high at CVSS 8.7. Red Hat has not stated a fixed version in the data available, so remediation should follow the vendor bulletin.
What to do
- Follow the Red Hat security bulletin for patches or mitigations and apply them.
- Audit the API 4XX log message template setting for anything beyond plain static text.
- Review external log aggregator destinations and inspect forwarded logs for leaked secrets.
- If the template was ever modified by an untrusted administrator, rotate the Django secret key, the database password, and all stored credentials.
- Restrict administrator grants to fully trusted operators until patched.
Management note
This flaw converts a rogue or compromised administrator into total platform compromise, including every stored credential. The attacker profile is narrow but the payoff is absolute, so treat any sign of template tampering as a full credential rotation event.