The vulnerability occurs in the automation-controller component of Red Hat Ansible Automation Platform 2.6 for RHEL 9. Survey questions of type password are intended to be write-only and stored encrypted, with only placeholders shown on read. However, when a schedule or workflow job template node is revalidated against a tightened survey specification, the controller decrypts the stored password and includes its plaintext value in the minimum/maximum length validation error message returned in the HTTP response. An attacker with delegated JobTemplate Admin privileges can exploit this by tightening the survey length constraints and triggering revalidation of schedules or nodes created by higher-privileged users, thereby extracting their stored passwords in plaintext.

This vulnerability allows a user with delegated JobTemplate Admin role to obtain plaintext passwords stored in survey questions of other users with higher privileges. The exposure of sensitive credential data can lead to unauthorized access and potential compromise of automated workflows or systems managed via Ansible Automation Platform. The CVSS score is 7.7 (high severity) with network attack vector, low attack complexity, and privileges required at the delegated admin level. Confidentiality impact is high, while integrity and availability impacts are not affected.

An official security update is available from Red Hat as detailed in the Red Hat Advisory RHSA-2026:71113. Users should apply the provided update to Red Hat Ansible Automation Platform 2.6 for RHEL 9 to remediate this vulnerability. No additional mitigation steps are required beyond applying the official patch.