CVE-2026-106504
Description
A flaw was found in plugin-scaffolder-backend. An authenticated user with permissions to create and read scaffolder tasks can observe sensitive values in task logs when an execution step is denied by action permissions. This flaw allows an attacker to access sensitive input data, resulting in information disclosure.
Statement
This vulnerability is rated as Moderate severity for Red Hat products because exploitation requires valid user authentication, permissions to create and inspect scaffolder tasks, and specific template configurations where an action containing sensitive data is denied by authorization policy. In typical deployments of Red Hat Developer Hub and Ansible Automation Platform, sensitive inputs are only exposed within task logs if permission checks fail on an action processing those inputs. Confidentiality is impacted only for users who already possess access to view execution logs, limiting the overall scope of exposure.
Mitigation
To mitigate this issue, implement operational and access control restrictions:
1. Restrict scaffolder task creation and task log viewing permissions exclusively to trusted users through the application permission policy framework.
2. Review scaffolder templates to avoid passing sensitive credentials or secrets into inputs of actions that are subject to permission denials.
Caveats: Restricting task creation and log inspection permissions limits self-service scaffolding capabilities for standard portal users.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
