{"id":"CVE-2026-71462","published":"2026-09-23T19:19:03.090","lastModified":"2026-09-24T07:16:32.787","description":"StringListPathField.to_internal_value() calls\n              os.path.exists() on unbounded user-supplied paths.\n              200 vs 400 response reveals existence of arbitrary\n              absolute paths on the controller-web pod. Tenant\n              superuser can confirm /etc/tower/SECRET_KEY, k8s\n              service-account token, receptor sockets, ConfigMap\n              mount points. Mainly impactful on managed AAP\n              (ansiblecloud.com) where tenant admin != host admin.","cvssScore":4.1,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","cwes":["CWE-204"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","tags":[]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71462","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512371","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}