CVE-2026-71459
Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated Job Event Tree Access in JobJobEventsChildrenSummary

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: redhat-SADP

Description
JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through (returns True) for any authenticated user. The view uses raw get_object_or_404(Job, pk) without DRF object-level permission check. Zero-privilege user reads event tree structure, event_processing_finished status, and enumerates Job IDs platform-wide via 200/404 oracle. Sibling endpoint /jobs/{id}/job_events/ correctly returns 403.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-71459
EUVD
EUVD-2026-85524

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
red_hat automation_controller *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Red Hat automation-controller allows authenticated users to bypass role-based access control (RBAC) restrictions. The JobJobEventsChildrenSummary view lacks proper model validation, causing the system to incorrectly grant access to any authenticated user. Attackers can view job event structures, job processing status, and enumerate valid job IDs across the platform by exploiting response differences between 200 and 404 status codes.

The flaw exists because the view uses raw get_object_or_404 without implementing Django REST Framework object-level permission checks. While a sibling endpoint correctly returns 403 for unauthorized users, this endpoint fails to enforce any restrictions.

Detection Guidance

Check for unauthorized access to the JobJobEventsChildrenSummary endpoint by monitoring HTTP requests to /jobs/{id}/job_events_children/. Look for 200 OK responses from authenticated users with no RBAC roles. Test by sending requests with minimal privileges and observe if event tree data or job IDs are exposed.

Impact Analysis

An attacker with minimal access could enumerate all job IDs on the platform and view sensitive job event details without proper authorization. This includes job processing status and organizational job structures, potentially exposing operational information across all organizations using the automation-controller.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating confidentiality requirements in GDPR and HIPAA. Exposure of job structures and processing status may constitute a data breach if it involves personal or protected health information.

Mitigation Strategies

Apply the latest patches from Red Hat for automation-controller. If patches are unavailable, restrict access to the JobJobEventsChildrenSummary endpoint via network policies or firewall rules. Monitor logs for suspicious access attempts to the vulnerable endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71459. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart