CVE-2026-84680

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching a Galaxy or Automation Hub credential to an organization through the galaxy_credentials relationship endpoint, the controller verifies only that the requesting user can read the credential, rather than that they hold use permission on it, unlike other credential consumption in the product. An authenticated user who administers one organization and has read-only visibility of a credential in another organization -- for example a platform auditor -- can bind that foreign credential to their own organization. On the next project synchronization the controller decrypts the credential server-side and uses its token to authenticate to the credential owner's Automation Hub, allowing cross-tenant use of another organization's secret.