CVE-2026-84720 describes a vulnerability in the Ansible Automation Platform automation-controller where the WorkflowJobNode.ancestor_artifacts database column is not wrapped in prevent_search(), allowing arbitrary field lookups via the REST filter backend. Although this column is omitted from the API serializer, it is persisted before Ansible's no_log masking is applied. Consequently, users with read access to a workflow or any authenticated user (via a regex lookup bypassing JSON cross-relation filter guards) can use the result count as an oracle to recover secret values that playbook authors marked as no_log, potentially exposing sensitive information across organizational boundaries.

The vulnerability enables unauthorized disclosure of secret values explicitly marked no_log in Ansible playbooks. This can occur even for users with minimal privileges, including those with only read access or any authenticated user exploiting a bypass. The exposure of sensitive data can compromise confidentiality across organizations using the automation platform.

A security update is available from Red Hat for Ansible Automation Platform 2.6 that addresses this vulnerability. Users should apply the official patch as detailed in Red Hat Advisory RHSA-2026:71113. Since a fix is provided, no additional mitigation steps are required beyond updating to the patched version.