CVE-2026-71461 Information disclosure in Red Hat Ansible Automation Platform 2
Authenticated users can trigger verbose error messages in the host list feature, leaking internal database schema and raw error details.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-71461?
CVE-2026-71461 is a medium-severity vulnerability in Red Hat Ansible Automation Platform 2, published on 23 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers Django FieldError (leaking complete Host model relation graph including internal reverse accessors) or PostgreSQL DataError (leaking raw database error strings). Two primitives: credential__search=x dumps ORM schema, name__regex=[bad reflects PostgreSQL errors.
Weakness: CWE-209
Which versions are affected by CVE-2026-71461?
How do I fix CVE-2026-71461?
No fix has been published for CVE-2026-71461 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-71461 being exploited?
There is no known exploitation of CVE-2026-71461 in the wild and no public exploit code.
Sources
Also known as GHSA-98xv-m2v4-crqh.