The vulnerability arises because the notification template Jinja AST whitelist in Red Hat Ansible Automation Platform 2 only inspects static Getattr nodes. Dynamic subscripts (e.g., job['job'+'_env']) and conditional gating (e.g., {% if job.id > 100 %}) bypass both the AST check and test-render phase. At runtime, the gated branch executes, and exceptions cause full tracebacks to be included in the notification body, which is then POSTed to an attacker-controlled webhook URL. This leaks sensitive information such as installation paths, Python version, and source line numbers. The CVSS v3.1 score is 2.7 (low severity) with network attack vector, low attack complexity, and high privileges required.

The vulnerability leads to the disclosure of sensitive information through error messages containing full tracebacks. This includes installation paths, Python version details, and source code line numbers. While the impact on confidentiality is low, it may aid an attacker in further reconnaissance or targeted attacks. There is no impact on integrity or availability.

No explicit patch or fix is stated in the vendor advisory at this time. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-71463 for current remediation guidance. Since the vulnerability requires high privileges and user interaction is not needed, mitigation may involve restricting access to notification templates and webhook configurations to trusted users only. Monitor Red Hat advisories for any forthcoming patches or official mitigations.