VDB

CVE-2026-71460

CVE-2026-71460 PUBLISHED CVSS 4.3 MEDIUM

Reported by redhat · Published September 23, 2026

/api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_id, sku, support_level, instance counts) returned to any authenticated user. The superuser/auditor gate only covers project_base_dir/project_local_paths/custom_virtualenvs, not license_info. Enables social engineering against Red Hat support and estate sizing reconnaissance.

Risk Scores

CVSS 3.1
4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected Products

VendorProductVersions
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:4.6.33-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:4.6.33-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 90:4.7.17-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.61789673739
Red HatRed Hat Ansible Automation Platform 2.71789580684
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:4.6.33-1.el9ap
Red HatRed Hat Ansible Automation Platform 2
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:4.6.33-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.61789673739
Red HatRed Hat Ansible Automation Platform 2.71789580684
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 90:4.7.17-1.el9ap, 0:4.7.17-1.el9ap
Red HatRed Hat Ansible Automation Platform 2

Timeline

  • Sep 23, 2026 Coalition ESS Score
  • Sep 23, 2026 CVE Published
  • Sep 24, 2026 EPSS Score
  • Sep 24, 2026 Distribution Patch
  • Sep 24, 2026 Security Advisory
  • Sep 26, 2026 EPSS Score
  • Oct 3, 2026 EPSS Score
  • Oct 7, 2026 EPSS Score
  • Oct 13, 2026 EPSS Score
  • Oct 16, 2026 CVE Updated
  • Oct 17, 2026 Distribution Patch
  • Oct 17, 2026 Distribution Patch

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›