CVE-2026-71461

MediumCVSS 4.3/10Last modified Oct 16, 2026

Description

HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers Django FieldError (leaking complete Host model relation graph including internal reverse accessors) or PostgreSQL DataError (leaking raw database error strings). Two primitives: credential__search=x dumps ORM schema, name__regex=[bad reflects PostgreSQL errors.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-209

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 23, 2026
Last modified: Oct 16, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-714624.1StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 resp CVE-2026-714632.7Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts (job['job'+'_env']) CVE-2026-714643.1LaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash check, unlike Project/Job CVE-2026-714653.1RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(CVE-2026-714677.5A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a reque CVE-2026-714685.3A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bear CVE-2026-714697.5A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each u CVE-2026-71477.3A vulnerability was detected in JoeCastrom mcp-chat-studio up to 1.5.0. Affected by this issue is some unknown functionality of the file ser CVE-2026-714709.1A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to mani CVE-2026-714719.0A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to th CVE-2026-714729.1A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom CVE-2026-714738.5A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed cluster can exploit a v