CVE-2026-71458 Information disclosure in Red Hat Ansible Automation Platform 2.5 for RHEL 8
Attackers can enumerate cross-tenant resource names via differential 404 responses, exposing internal hostnames and organizational structures.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-71458?
CVE-2026-71458 is a medium-severity vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8, published on 23 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. Differential "Not found." vs "No <Model> matches..." reveals whether a named resource (org, credential, inventory, host) exists anywhere on the platform. Enables cross-tenant internal hostname enumeration.
Weakness: CWE-204
Which versions are affected by CVE-2026-71458?
How do I fix CVE-2026-71458?
Apply the vendor's patch.
Is CVE-2026-71458 being exploited?
There is no known exploitation of CVE-2026-71458 in the wild and no public exploit code.
Sources
Also known as GHSA-2wm8-q2cf-p9fx.