The vulnerability CVE-2026-71460 affects Red Hat Ansible Automation Platform 2. The /api/v2/config/ endpoint is protected solely by an authentication check (IsAuthenticated) without enforcing authorization controls on the license_info data. Consequently, any authenticated user can retrieve sensitive subscription and license details including account number, subscription ID, pool ID, SKU, support level, and instance counts. The more restrictive superuser/auditor authorization gate applies only to project_base_dir, project_local_paths, and custom_virtualenvs, but not to license_info. This missing authorization (CWE-862) could facilitate social engineering attacks against Red Hat support and allow attackers to perform estate sizing reconnaissance. The CVSS v3.1 base score is 4.3 (medium severity) with network attack vector, low complexity, low privileges required, no user interaction, and only confidentiality impact.

An attacker with any authenticated access to the platform can read sensitive Red Hat subscription and license information that is not properly protected by authorization controls. This information disclosure could be leveraged for social engineering attacks against Red Hat support or to gather intelligence about the customer's Red Hat estate size. There is no direct impact on integrity or availability. The vulnerability does not allow privilege escalation or code execution but exposes confidential data to unauthorized users.

Red Hat has published an advisory for CVE-2026-71460. The vendor advisory does not explicitly state that a patch or fix is currently available. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-71460 for current remediation guidance. Until a fix is available, restrict authenticated user access to trusted personnel only and monitor for unusual access patterns. No specific mitigations are described in the advisory beyond awaiting a fix.