CVE-2026-84713

/// Technical description

A flaw was found in the automation-controller notification

subsystem. Although NotificationTemplate.notification_

configuration is protected from API filtering, its recipient

value is copied in clear text into the unprotected

Notification.recipients field on every send. Because the

credential-types endpoint is listable by any authenticated

user and the API filter backend traverses object relations

without per-hop authorization, a user with no privileges can

use a relational filter as a boolean count-oracle to recover,

character by character and across organizations, the secret

recipient values of other tenants' notifications — including

PagerDuty service keys and Slack/Mattermost/RocketChat/Webhook

bearer-token URLs. This flaw affects confidentiality.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References