Threats Tagged 'ghsa-2wm8-q2cf-p9fx'

CVE-2026-71458 is a vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8 where the URLModificationMiddleware resolves named-URL lookups against unfiltered model objects before RBAC enforcement. This causes a difference in 403 versus 404 response messages, allowing an attacker to distinguish whether certain named resources exist anywhere on the platform. This enables cross-tenant internal hostname enumeration. The vulnerability has a medium severity with a CVSS score of 5. A vendor advisory is available but does not explicitly confirm patch status for this specific issue.