CVE-2026-71458
Awaiting Analysis Awaiting Analysis - Queue

URL Modification Bypass in Django URLModificationMiddleware

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: redhat-SADP

Description
URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. Differential "Not found." vs "No <Model> matches..." reveals whether a named resource (org, credential, inventory, host) exists anywhere on the platform. Enables cross-tenant internal hostname enumeration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-71458
EUVD
EUVD-2026-85523

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
red_hat automation_controller *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-204 The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the URLModificationMiddleware in Red Hat's automation-controller. It resolves named-URL lookups against unfiltered database queries before applying role-based access control (RBAC). This creates inconsistent error responses where attackers can distinguish between 'resource not found' and 'access denied' messages, enabling them to enumerate sensitive resource names like organizations, credentials, or hostnames across different tenants.

Detection Guidance

Monitor for inconsistent 403 and 404 error responses when accessing named resources. Check middleware logs for discrepancies between 'Not found' and 'No matches...' messages in error responses. Use automated tools to scan for observable response differences in named-URL lookups.

Impact Analysis

An attacker could exploit this to determine if specific resources exist on the platform, such as organization names or hostnames. This information disclosure could aid further attacks, including cross-tenant data breaches or targeted exploits against known resources. The impact is primarily on confidentiality, allowing unauthorized access to sensitive system details.

Compliance Impact

This vulnerability may violate compliance requirements under GDPR and HIPAA by enabling unauthorized information disclosure. GDPR mandates protection of personal data, while HIPAA requires safeguarding protected health information. The flaw could lead to unauthorized access to sensitive resource names, potentially exposing personal or confidential data and resulting in regulatory penalties or breaches of trust.

Mitigation Strategies

Apply RBAC checks before named-URL resolution to prevent unfiltered lookups. Standardize error responses to avoid revealing resource existence. Monitor Red Hat's official channels for patches and updates. Review middleware configurations to ensure consistent 403-to-404 handling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71458. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart