CVE-2026-71463Low· 2.7▾ SunlitNotification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts (job['job'+'_env']) and {% if job.id > 100 %} conditional gating bypass both the AST check and the…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 14.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts (job['job'+'_env']) and {% if job.id > 100 %} conditional gating bypass both the AST check and the test-render (stub has small job.id). At runtime, the gated branch executes and exceptions write full tracebacks into notification body, which is POSTed to attacker-controlled webhook URL. Leaks install paths, Python version, source line numbers.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-84499High· 7.7A flaw was found in Red Hat Ansible Automation Platform's automation- controller
CVE-2026-71461Medium· 4.3HostList.list() catches bare Exception and returns str(e) verbatim
CVE-2026-84724Medium· 6.6An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem
CVE-2026-85475High· 7.2A flaw was found in the Ansible Automation Platform automation controller
CVE-2026-84719Critical· 9.9A flaw was found in the Ansible Automation Platform automation-controller
CVE-2026-84720Medium· 6.5A flaw was found in the Ansible Automation Platform automation-controller