CVE-2026-71461
Awaiting Analysis Awaiting Analysis - Queue

Information Disclosure in HostList Django Application

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: redhat-SADP

Description
HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers Django FieldError (leaking complete Host model relation graph including internal reverse accessors) or PostgreSQL DataError (leaking raw database error strings). Two primitives: credential__search=x dumps ORM schema, name__regex=[bad reflects PostgreSQL errors.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-71461
EUVD
EUVD-2026-85535

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
red_hat automation_controller *
red_hat automation_controller_container *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability occurs in Red Hat's automation-controller where the HostList.list() function catches exceptions and returns their error messages directly. Authenticated users can manipulate inputs like host_filter to trigger Django FieldError or PostgreSQL DataError, exposing internal system details such as the Host model's relation graph or raw database errors.

Detection Guidance

To detect this vulnerability, monitor for unusual error messages in application logs when using host_filter, credential__search, or name__regex parameters. Check for Django FieldError or PostgreSQL DataError exceptions that expose internal details. Review network traffic for requests triggering these parameters with malformed inputs.

Impact Analysis

An attacker with authenticated access could exploit this to leak sensitive internal system information, including database schema or error details. This could help them plan further attacks by understanding the system's structure or weaknesses.

Compliance Impact

This vulnerability violates CWE-209 by exposing internal exception details, which may lead to non-compliance with data protection regulations like GDPR or HIPAA. Disclosing database errors or system internals could be considered a breach of confidentiality requirements.

Mitigation Strategies

Apply patches or updates from Red Hat for automation-controller. Disable verbose error messages in production environments. Implement input validation for host_filter, credential__search, and name__regex parameters. Monitor logs for suspicious activity related to these endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71461. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart