VDB

CVE-2026-71462

CVE-2026-71462 PUBLISHED CVSS 4.1 MEDIUM

Reported by redhat · Published September 23, 2026

StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRET_KEY, k8s service-account token, receptor sockets, ConfigMap mount points. Mainly impactful on managed AAP (ansiblecloud.com) where tenant admin != host admin.

Risk Scores

CVSS 3.1
4.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Affected Products

VendorProductVersions
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:4.6.33-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:4.6.33-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 90:4.7.17-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.61789673739
Red HatRed Hat Ansible Automation Platform 2.71789580684
Red HatRed Hat Ansible Automation Platform 2
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:4.6.33-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 90:4.7.17-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.61789673739
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:4.6.33-1.el8ap
Red HatRed Hat Ansible Automation Platform 2
Red HatRed Hat Ansible Automation Platform 2.71789580684

Timeline

  • Sep 23, 2026 Coalition ESS Score
  • Sep 23, 2026 CVE Published
  • Sep 24, 2026 EPSS Score
  • Sep 24, 2026 Distribution Patch
  • Sep 24, 2026 Security Advisory
  • Sep 26, 2026 EPSS Score
  • Oct 1, 2026 EPSS Score
  • Oct 6, 2026 EPSS Score
  • Oct 10, 2026 EPSS Score
  • Oct 13, 2026 EPSS Score
  • Oct 16, 2026 EPSS Score
  • Oct 17, 2026 Distribution Patch

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›