The vulnerability arises from the use of os.path.exists() on user-supplied paths without proper bounds checking in the StringListPathField.to_internal_value() function of Red Hat Ansible Automation Platform 2. This causes an observable response discrepancy (HTTP 200 vs 400) that acts as a filesystem path-existence oracle on the controller-web pod. A tenant superuser can leverage this to confirm the presence of sensitive files and directories, including secrets and tokens. The vulnerability mainly affects managed AAP deployments where tenant administrators do not have host-level administrative rights, potentially exposing confidential information. The CVSS v3.1 base score assigned by Red Hat is 4.1 (medium severity) with network attack vector, low attack complexity, high privileges required, no user interaction, and confidentiality impact limited to low.

The vulnerability allows an attacker with tenant superuser privileges to confirm the existence of arbitrary absolute paths on the controller-web pod, potentially revealing sensitive information such as secret keys, Kubernetes service-account tokens, receptor sockets, and ConfigMap mount points. This leads to a confidentiality impact rated as low. There is no impact on integrity or availability. The issue is mainly significant in managed Ansible Automation Platform environments where tenant admin privileges are separated from host admin privileges.

As of the latest Red Hat advisory, no explicit patch or fix release information is provided. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-71462 for current remediation guidance. Customers should monitor the advisory for updates. No vendor advisory states that no action is required or that the issue is already mitigated. Given the nature of the vulnerability, limiting tenant superuser privileges and avoiding exposure of the controller-web pod to untrusted users may reduce risk until a fix is available.