The vulnerability arises from the automation-controller's use of an administrator-controlled Python format-string template for API 4XX error logs. Because Python string formatting permits attribute and item traversal, an attacker with administrator privileges can create a format string that traverses from the user object into application settings, extracting the Django secret key and database password. The resulting log message is sent to a logger that can forward logs to an external aggregator, also controlled by the administrator, allowing exfiltration of these secrets. This compromises the master encryption key protecting stored credentials and the database service password, enabling offline decryption of all stored credentials, user session forgery, and direct access to the controller database.

An authenticated system administrator can disclose the Django SECRET_KEY and database credentials. This leads to the compromise of all stored credentials through offline decryption, forgery of user sessions, and unauthorized direct access to the controller's database. The vulnerability has a CVSS 3.1 score of 8.7 (high severity) with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts confidentiality and integrity with no impact on availability.

The vendor advisory does not explicitly state the patch status or mitigation steps in the provided content. Therefore, patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-84691 for current remediation guidance. Since exploitation requires authenticated administrator privileges, restricting administrator access and monitoring configuration changes to logging templates may reduce risk until a fix is applied.