CVE-2026-84713: Authorization Bypass Through User-Controlled Key in Red Hat Red Hat Ansible Automation Platform 2
A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ configuration is protected from API filtering, its recipient value is copied in clear text into the unprotected Notification.recipients field on every send. Because the credential-types endpoint is listable by any authenticated user and the API filter backend traverses object relations without per-hop authorization, a user with no privileges can use a relational filter as a boolean count-oracle to recover, character by character and across organizations, the secret recipient values of other tenants' notifications — including PagerDuty service keys and Slack/Mattermost/RocketChat/Webhook bearer-token URLs. This flaw affects confidentiality.
AI Analysis
Technical Summary
The vulnerability exists because NotificationTemplate.notification_ configuration is protected from API filtering, but its recipient value is copied in clear text into the unprotected Notification.recipients field on every send. The credential-types endpoint is listable by any authenticated user, and the API filter backend traverses object relations without per-hop authorization. This allows a low-privileged user to use a relational filter as a boolean count-oracle to recover secret recipient values character by character across organizations, impacting confidentiality.
Potential Impact
An attacker with no privileges beyond authentication can access sensitive notification recipient secrets belonging to other tenants, including PagerDuty service keys and bearer-token URLs for Slack, Mattermost, RocketChat, and webhooks. This compromises confidentiality but does not affect integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-84713 for current remediation guidance. No specific mitigation steps are provided in the advisory. Monitor the vendor advisory for updates on fixes or mitigations.
CVE-2026-84713: Authorization Bypass Through User-Controlled Key in Red Hat Red Hat Ansible Automation Platform 2
Description
A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ configuration is protected from API filtering, its recipient value is copied in clear text into the unprotected Notification.recipients field on every send. Because the credential-types endpoint is listable by any authenticated user and the API filter backend traverses object relations without per-hop authorization, a user with no privileges can use a relational filter as a boolean count-oracle to recover, character by character and across organizations, the secret recipient values of other tenants' notifications — including PagerDuty service keys and Slack/Mattermost/RocketChat/Webhook bearer-token URLs. This flaw affects confidentiality.
CVSS v3.1
Score 6.5medium
Affected software
Red Hat
Red Hat Ansible Automation Platform 2
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists because NotificationTemplate.notification_ configuration is protected from API filtering, but its recipient value is copied in clear text into the unprotected Notification.recipients field on every send. The credential-types endpoint is listable by any authenticated user, and the API filter backend traverses object relations without per-hop authorization. This allows a low-privileged user to use a relational filter as a boolean count-oracle to recover secret recipient values character by character across organizations, impacting confidentiality.
Potential Impact
An attacker with no privileges beyond authentication can access sensitive notification recipient secrets belonging to other tenants, including PagerDuty service keys and bearer-token URLs for Slack, Mattermost, RocketChat, and webhooks. This compromises confidentiality but does not affect integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-84713 for current remediation guidance. No specific mitigation steps are provided in the advisory. Monitor the vendor advisory for updates on fixes or mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-09-02T00:50:40.363Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-84713","vendor":"Red Hat"}]
Threat ID: 6ab42d09f7a7c541063f0e45
Added to database: 09/23/2026, 19:48:25 UTC
Last enriched: 09/23/2026, 20:19:48 UTC
Last updated: 09/24/2026, 01:57:04 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.