Threats Tagged 'ghsa-8936-fch2-2279'

CVE-2026-71462 is a vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8 where the StringListPathField.to_internal_value() function calls os.path.exists() on unbounded user-supplied paths. This behavior allows a tenant superuser to confirm the existence of arbitrary absolute paths on the controller-web pod by observing different HTTP response codes (200 vs 400). This can expose sensitive files such as /etc/tower/SECRET_KEY, Kubernetes service-account tokens, receptor sockets, and ConfigMap mount points. The issue is mainly impactful in managed Ansible Automation Platform environments where tenant administrators do not have host administrator privileges.