CVE-2026-71462 Information disclosure in Red Hat Ansible Automation Platform 2.5 for RHEL 8
Tenant superusers can determine the existence of arbitrary files on the controller pod via path validation responses, potentially revealing sensitive configuration details.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-71462?
CVE-2026-71462 is a medium-severity vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8, published on 23 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRET_KEY, k8s service-account token, receptor sockets, ConfigMap mount points. Mainly impactful on managed AAP (ansiblecloud.com) where tenant admin != host admin.
Weakness: CWE-204
Which versions are affected by CVE-2026-71462?
How do I fix CVE-2026-71462?
Apply the vendor's patch.
Is CVE-2026-71462 being exploited?
There is no known exploitation of CVE-2026-71462 in the wild and no public exploit code.
Sources
Also known as GHSA-8936-fch2-2279.