The vulnerability arises from HostList.list() catching all exceptions and returning the exception message string directly. By using the host_filter parameter, an authenticated user can cause Django FieldError exceptions that reveal the complete Host model relation graph, including internal reverse accessors, or PostgreSQL DataError exceptions that leak raw database error messages. Specifically, using credential__search=x exposes the ORM schema, and name__regex=[bad triggers PostgreSQL error reflections. This results in information disclosure of internal application and database schema details.

The vulnerability leads to information disclosure of sensitive internal data structures, including the ORM schema and database error messages. This could aid an attacker in understanding the internal workings of the application and database, potentially facilitating further attacks. The CVSS score of 4.3 indicates a medium severity impact with confidentiality loss but no integrity or availability impact.

The vendor advisory from Red Hat should be consulted for the official remediation status. No patch or fix information is provided in the input data. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-71461 for current remediation guidance. Until a fix is applied, limit authenticated user access to trusted users and avoid exposing the vulnerable functionality unnecessarily.