4.1
Medium
CVE-2026-71462 Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control pod
Description
StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRET_KEY, k8s service-account token, receptor sockets, ConfigMap mount points. Mainly impactful on managed AAP (ansiblecloud.com) where tenant admin != host admin.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:NExploitable remotely over the network, with an administrator account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- Interaction
- None
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Versions not published | |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 1789673739 | earliest → < 1789673739 | 1789673739 |
| Red Hat Ansible Automation Platform 2.7 1789580684 | earliest → < 1789580684 | 1789580684 |
References
- RHSA-2026:71113 access.redhat.com
- RHSA-2026:71114 access.redhat.com
- RHSA-2026:71177 access.redhat.com
- RHSA-2026:71179 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2512371 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Ansible Automation Platform 2
The 210 CVEs of Red Hat Ansible Automation Platform 2 →
CVE-2026-114236
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a…
3.3
Low
CVE-2026-109131
Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)
5.4
Medium
CVE-2026-92982
A flaw was found in Ansible Operator Plugins
8.5
High
CVE-2026-89091
Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution
8.8
High