CVE-2026-71462
Fixed in a distro release EPSS <1%CVSS 4.1
StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRET_KEY, k8s service-account token, receptor sockets, ConfigMap mount points. Mainly impactful on managed AAP (ansiblecloud.com) where tenant admin != host admin.
Products: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Ansible Automation Platform 2.6, Red Hat Ansible Automation Platform 2.7
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat ansible automation platform 2.5 | automation-controller-venv-tower | 0:4.6.33-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-controller-venv-tower | 0:4.6.33-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-proxy-server | 0:2.5.10-8.el8ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-proxy-server | 0:2.6.17-3.el9ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-server | 0:2.5.20260923-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-server | 0:2.5.20260923-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.12-gitpython | 0:3.1.60-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.12-gitpython | 0:3.1.60-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.12-sqlparse | 0:0.6.0-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.12-sqlparse | 0:0.6.0-1.el8ap |
| Red Hat ansible automation platform 2.5 | receptor | 0:1.6.8-1.el9ap |
| Red Hat ansible automation platform 2.5 | receptor | 0:1.6.8-1.el8ap |
| Red Hat ansible automation platform 2.6 | automation-controller | 0:4.7.17-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-cli | 0:4.7.17-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-server | 0:4.7.17-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-ui | 0:4.7.17-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-venv-tower | 0:4.7.17-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-gateway-proxy-server | 0:2.6.17-3.el9ap |
| Red Hat ansible automation platform 2.6 | automation-platform-ui | 0:2.6.14-1.el9ap |
| Red Hat ansible automation platform 2.6 | python-sqlparse | 0:0.6.0-1.el10ap |
| Red Hat ansible automation platform 2.6 | python3-sqlparse | 0:0.6.0-1.el10ap |
| Red Hat ansible automation platform 2.6 | python3.12-gitpython | 0:3.1.60-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-sqlparse | 0:0.6.0-1.el9ap |
| Red Hat ansible automation platform 2.6 | receptor | 0:1.6.8-1.el10ap |
| Red Hat ansible automation platform 2.6 | receptor | 0:1.6.8-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | python3.12-sqlparse | 0:0.6.0-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | python3.12-sqlparse | 0:0.6.0-1.el8ap |
| Red Hat ansible automation platform developer 2.5 | receptor | 0:1.6.8-1.el8ap |
| Red Hat ansible automation platform developer 2.5 | receptor | 0:1.6.8-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | automation-controller | 0:4.7.17-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | automation-controller-cli | 0:4.7.17-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | python-sqlparse | 0:0.6.0-1.el10ap |
| Red Hat ansible automation platform developer 2.6 | python3-sqlparse | 0:0.6.0-1.el10ap |
| Red Hat ansible automation platform developer 2.6 | python3.12-sqlparse | 0:0.6.0-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | receptor | 0:1.6.8-1.el9ap |
| Red Hat ansible automation platform inside 2.5 | receptor | 0:1.6.8-1.el9ap |
| Red Hat ansible automation platform inside 2.5 | receptor | 0:1.6.8-1.el8ap |
| Red Hat ansible automation platform inside 2.6 | receptor | 0:1.6.8-1.el9ap |