Ansible Automation Platform EUVD-2026-85561

Exploitation requires (1) an account with the delegated JobTemplate Admin role in Red Hat Ansible Automation Platform 2 automation-controller, (2) the existence of a survey containing a password-type question with a stored (encrypted) value, and (3) a schedule or workflow job template node created by a higher-privileged user that references that survey password. The attacker must be able to tighten the survey's min/max length constraint and then trigger revalidation of the victim's schedule/node against the tightened spec, at which point the plaintext password is returned in the length-validation error. Limiting factors: it is not exploitable by unauthenticated users (PR:L role delegation required), it only leaks secrets that another user has actually stored in a survey password field, and it depends on the survey-question feature being in use - it is not a default-configuration remote break.

This is a genuine, well-characterized credential-disclosure flaw that warrants prioritization in AAP environments using survey passwords, though it is a lateral/privilege-crossing issue rather than a mass-exploitable perimeter break. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) is internally consistent with the description: network-accessible controller API, low complexity, and low privileges (a delegated JobTemplate Admin role) needed. S:C is justified because the attacker recovers a credential belonging to a DIFFERENT, higher-privileged user, crossing an authorization scope boundary; C:H reflects plaintext recovery of a secret while I:N/A:N correctly reflect a read-only impact. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no signal of active exploitation or automated exploitation at scale - consistent with a bug requiring an authenticated foothold and a specific role delegation. No SSVC decision data was provided. The primary limiting factor is that the attacker must already hold delegated JobTemplate Admin over (or otherwise be able to tighten the survey spec and trigger revalidation of) a schedule/node owned by a higher-privileged user, making this an insider/privilege-escalation-of-secrets scenario rather than an unauthenticated internet-facing threat.

An operator holding the delegated JobTemplate Admin role edits a survey specification to tighten the minimum/maximum length constraint on a password-type question, then triggers revalidation of a schedule or workflow node that a higher-privileged user created with a stored survey password. The controller decrypts the stored secret and echoes its plaintext value inside the length-validation error returned in the HTTP response, letting the lower-privileged user harvest the higher-privileged user's credential. No public exploit code was identified at time of analysis, but the technique is deterministic and requires no special tooling beyond normal API access.