CVE-2026-84691 is a high-severity vulnerability in Red Hat Ansible Automation Platform's automation-controller. The issue arises because the log message formatting for API 4XX errors uses an administrator-controlled Python format-string template rendered with a live user object. Python string formatting allows attribute and item traversal, enabling an attacker with administrator privileges to craft a template that accesses sensitive application settings, including the Django secret key and database password. These secrets are logged and can be forwarded to an external log aggregator, also controlled by the administrator, facilitating exfiltration. The compromise of these secrets allows offline decryption of stored credentials, forgery of user sessions, and direct access to the controller database.

An authenticated administrator can obtain critical secrets such as the master encryption key and database password, leading to full compromise of stored credentials, session forgery, and database access. This significantly elevates the risk of unauthorized data access and control over the automation platform.

Red Hat has issued an official security advisory (RHSA-2026:71113) providing updates that address this vulnerability in Red Hat Ansible Automation Platform 2.6. Users should apply the vendor-provided patches promptly to remediate the issue. No additional mitigation actions are required beyond applying the official fix.