CVE-2026-71461Medium· 4.3▾ SunlitHostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers Django FieldError (leaking complete Host model relation graph including intern…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers Django FieldError (leaking complete Host model relation graph including internal reverse accessors) or PostgreSQL DataError (leaking raw database error strings). Two primitives: credential__search=x dumps ORM schema, name__regex=[bad reflects PostgreSQL errors.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-85475High· 7.2A flaw was found in the Ansible Automation Platform automation controller
CVE-2026-84721Medium· 6.4A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend
CVE-2026-84713Medium· 6.5A flaw was found in the automation-controller notification subsystem
CVE-2026-84499High· 7.7A flaw was found in Red Hat Ansible Automation Platform's automation- controller
CVE-2026-76648High· 8.5CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC
CVE-2026-71463Low· 2.7Notification template Jinja AST whitelist only inspects static Getattr nodes