The vulnerability in Red Hat Ansible Automation Platform 2 automation-controller involves the WorkflowJobNode.ancestor_artifacts database column, which stores raw merged set_stats artifacts between workflow nodes. This column is not wrapped in prevent_search(), allowing arbitrary field lookups via the REST filter backend, even though it is omitted from the API serializer. Because the data is persisted before Ansible's no_log masking is applied, a user with read access to a workflow or any authenticated user with no roles (via a regex lookup bypassing JSON cross-relation filters) can use the result count as a boolean/count oracle to recover secret values marked no_log, including across organizations. The flaw is an authorization bypass through user-controlled keys, enabling information disclosure of sensitive secrets.

This vulnerability allows unauthorized users with minimal privileges to infer secret values that are intended to be masked by Ansible's no_log feature. Confidentiality is impacted as secret data can be recovered character by character. Integrity and availability are not affected. The exposure can occur across organizational boundaries. The CVSS v3.1 score is 6.5 (medium severity) with a network attack vector, low attack complexity, and low privileges required.

As of the vendor advisory, no explicit patch or fix release information is provided in the input data. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-84720 for current remediation guidance. The correct fix involves wrapping the affected database column in prevent_search() and redacting no_log keys before persistence. Until a fix is available, restrict read access to workflows and monitor for unusual queries that may exploit this vulnerability.