4.3
Medium
CVE-2026-71461 HostList.list() catches bare Exception and returns str(e) verbatim
Description
HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers Django FieldError (leaking complete Host model relation graph including internal reverse accessors) or PostgreSQL DataError (leaking raw database error strings). Two primitives: credential__search=x dumps ORM schema, name__regex=[bad reflects PostgreSQL errors.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat Ansible Automation Platform 2.7 1789580684 | earliest → < 1789580684 | 1789580684 |
References
- RHSA-2026:71177 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2512370 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Ansible Automation Platform 2
The 211 CVEs of Red Hat Ansible Automation Platform 2 →
CVE-2026-123037
Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)
6.7
Medium
CVE-2026-114236
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a…
3.3
Low
CVE-2026-109131
Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)
5.4
Medium
CVE-2026-92982
A flaw was found in Ansible Operator Plugins
8.5
High