CVE-2026-71462

MediumCVSS 4.1/10Last modified Nov 5, 2026

Description

StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRET_KEY, k8s service-account token, receptor sockets, ConfigMap mount points. Mainly impactful on managed AAP (ansiblecloud.com) where tenant admin != host admin.

Metrics

CVSS 3.1 4.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-204

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 8—
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 8—
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 9—
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 9—
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 9—
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 9—
Red HatRed Hat Ansible Automation Platform 2.6—
Red HatRed Hat Ansible Automation Platform 2.7—

References

Timeline

Published
Sep 23, 2026
Last modified
Nov 5, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-714632.7Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts (job['job'+'_env']) CVE-2026-714643.1LaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash check, unlike Project/JobCVE-2026-714653.1RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(CVE-2026-714677.5A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a requeCVE-2026-714685.3A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearCVE-2026-714697.5A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each uCVE-2026-71477.3A vulnerability was detected in JoeCastrom mcp-chat-studio up to 1.5.0. Affected by this issue is some unknown functionality of the file serCVE-2026-714709.1A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to maniCVE-2026-714719.0A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to thCVE-2026-714729.1A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search CustomCVE-2026-714738.5A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed cluster can exploit a vCVE-2026-714747.1A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cl
CVE-2026-71462: Medium severity, CVSS 4.1 | Vulnix