--- id: CVE-2026-71462 title: |- StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod summary: |- StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenan… severity: medium cvss: 4.1 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N' cwe: - CWE-204 vendor: Red Hat product: automation-controller affected: - automation-controller (all versions) - automation-controller (all versions) - automation-controller (all versions) - ansible-automation-platform-26/controller-rhel9 (all versions) - ansible-automation-platform-27/controller-rhel9 (all versions) patched: - ansible_automation_platform_2_5_for_rhel 8 - ansible_automation_platform_2_5_for_rhel 9 - ansible_automation_platform_2_6_for_rhel 9 - ansible_automation_platform 2.6 - ansible_automation_platform 2.7 published: '2026-09-23' updated: '2026-09-24' sourceUpdated: '2026-09-24T07:16:32.787' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71462' references: - url: 'https://access.redhat.com/errata/RHSA-2026:71113' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71114' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71177' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71179' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2026-71462' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2512371' label: secalert@redhat.com - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71462.json - url: 'https://www.cve.org/CVERecord?id=CVE-2026-71462' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71462' tags: - nvd - cve.org - csaf - vex - red-hat ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2026-09-23T19:31:20.113468Z' ingestedAt: '2026-09-23T19:31:04.463Z' epss: 0.00255 epssPercentile: 0.15235 --- ## Overview StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRET_KEY, k8s service-account token, receptor sockets, ConfigMap mount points. Mainly impactful on managed AAP (ansiblecloud.com) where tenant admin != host admin. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:71114** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71114) - **RHSA-2026:71113** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71113) - **RHSA-2026:71179** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71179) - **RHSA-2026:71177** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71177)