VDB
CVE-2026-71461
CVE-2026-71461
PUBLISHED
CVSS 4.3 MEDIUM
Reported by redhat · Published September 23, 2026
HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers Django FieldError (leaking complete Host model relation graph including internal reverse accessors) or PostgreSQL DataError (leaking raw database error strings). Two primitives: credential__search=x dumps ORM schema, name__regex=[bad reflects PostgreSQL errors.
Risk Scores
CVSS 3.1
4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.7 | 1789580684 |
| Red Hat | Red Hat Ansible Automation Platform 2 | |
| Red Hat | Red Hat Ansible Automation Platform 2 | |
| Red Hat | Red Hat Ansible Automation Platform 2 | |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | 1789580684 |
| Red Hat | Red Hat Ansible Automation Platform 2 | |
| Red Hat | Red Hat Ansible Automation Platform 2 |
Timeline
- Sep 23, 2026 Coalition ESS Score
- Sep 23, 2026 CVE Published
- Sep 24, 2026 EPSS Score
- Sep 26, 2026 EPSS Score
- Oct 6, 2026 EPSS Score
- Oct 11, 2026 EPSS Score
- Oct 16, 2026 EPSS Score
- Oct 16, 2026 CVE Updated
- Oct 17, 2026 Distribution Patch
- Oct 17, 2026 Security Advisory
- Oct 21, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
References
- RHSA-2026:71177 vendor-advisoryx_refsource_REDHAT
- vdb-entryx_refsource_REDHAT
- RHBZ#2512370 issue-trackingx_refsource_REDHAT