Threats Tagged 'ghsa-8jrq-6pp4-m2h6'

CVE-2026-71460 is a medium severity vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8 where the /api/v2/config/ endpoint is protected only by authentication but lacks proper authorization. This allows any authenticated user to access license information including account number, subscription ID, pool ID, SKU, support level, and instance counts. The vulnerability does not affect confidentiality or integrity beyond license data disclosure and does not allow privilege escalation or code execution. It enables potential social engineering and reconnaissance against Red Hat support and customer estate sizing. A vendor advisory is available but does not explicitly confirm patch status for this specific CVE. The CVSS 3.1 base score is 4.3 (medium).