CVE-2026-71463 Information disclosure in Red Hat Ansible Automation Platform 2.5 for RHEL 8
Attackers can bypass Jinja whitelist restrictions to leak sensitive traceback information via notification webhooks in Ansible Automation Platform.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-71463?
CVE-2026-71463 is a low-severity vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8, published on 23 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts (job['job'+'_env']) and {% if job.id > 100 %} conditional gating bypass both the AST check and the test-render (stub has small job.id). At runtime, the gated branch executes and exceptions write full tracebacks into notification body, which is POSTed to attacker-controlled webhook URL. Leaks install paths, Python version, source line numbers.
Weakness: CWE-209
Which versions are affected by CVE-2026-71463?
How do I fix CVE-2026-71463?
Apply the vendor's patch.
Is CVE-2026-71463 being exploited?
There is no known exploitation of CVE-2026-71463 in the wild and no public exploit code.
Sources
Also known as GHSA-wm9g-p29j-v3wh.