The vulnerability arises because URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects prior to RBAC checks. While a 403 response is rewritten to a 404, a specific path with pk=0 returns a different 404 detail string. This differential response—"Not found." versus "No <Model> matches..."—allows an attacker to determine the existence of named resources anywhere on the platform, enabling cross-tenant internal hostname enumeration. The CVSS v3.1 base score is 5.0 (medium) with network attack vector, low attack complexity, low privileges required, no user interaction, changed scope, and low confidentiality impact. The issue is tracked by Red Hat under Bugzilla 2512367 and CWE-204 (Observable Response Discrepancy).

An attacker with low privileges can leverage the observable difference in 404 responses to enumerate internal resource names across tenants on the platform. This information disclosure can aid in reconnaissance but does not directly impact integrity or availability. The confidentiality impact is rated low.

Red Hat has published an advisory for CVE-2026-71458 but does not explicitly state a patch or fix availability in the provided content. Patch status is not yet confirmed—check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-71458 for current remediation guidance. No vendor advisory states that no action is required or that the issue is already mitigated. Users should monitor the advisory for updates and apply fixes when available.