CVE-2026-71462Medium· 4.1▾ Sunlit

StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod

StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenan…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score23/ 100 · Low

impact 22.5 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Sep 23, 2026

Updated

Sep 24, 2026

CVSS

4.1

Vendor

Red Hat

Product

automation-controller

CWE

CWE-204

Depth score

23 · Low

EPSS

0.26% · p15

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

CISA SSVC

decided 2026-09-23

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 2 days

Sep 23, 2026Published
Disclosed via NVD
Sep 24, 2026Record revised
Last analysed / modified upstream
Sep 25, 2026EPSS first tracked
0.3%

Red Hat CWE-204 #nvd #cve.org #csaf #vex #red-hat

Affected

automation-controller (all versions)
automation-controller (all versions)
automation-controller (all versions)
ansible-automation-platform-26/controller-rhel9 (all versions)
ansible-automation-platform-27/controller-rhel9 (all versions)

Patched in

ansible_automation_platform_2_5_for_rhel 8
ansible_automation_platform_2_5_for_rhel 9
ansible_automation_platform_2_6_for_rhel 9
ansible_automation_platform 2.6
ansible_automation_platform 2.7

Full technical detail▾

Overview

StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRET_KEY, k8s service-account token, receptor sockets, ConfigMap mount points. Mainly impactful on managed AAP (ansiblecloud.com) where tenant admin != host admin.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Vendor advisories

RHSA-2026:71114 · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-09-23 · advisory
RHSA-2026:71113 · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-09-23 · advisory
RHSA-2026:71179 · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-09-23 · advisory
RHSA-2026:71177 · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-09-23 · advisory

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org#csaf#vex#red-hat

← Back to feed