CVE-2026-84691

*** Pendiente de traducción *** A flaw was found in Red Hat Ansible Automation Platform&amp;#39;s automation-<br /> controller. The setting that formats the log message emitted for API 4XX errors<br /> is an administrator-controlled Python format-string template that is rendered<br /> with a live user object as an argument. Because Python string formatting permits<br /> attribute and item traversal on its arguments, an administrator can craft a<br /> template that walks from the user object into the application settings and reads<br /> the Django secret key and the database password. The formatted message is written<br /> to a logger that can be forwarded to an external log aggregator, whose destination<br /> is also administrator-controlled, allowing the secrets to be sent off the host. An<br /> authenticated administrator can thereby obtain the master encryption key used to<br /> protect all stored credentials and the database service password, enabling offline<br /> decryption of every stored credential, forgery of user sessions, and direct<br /> access to the controller database.