CVE-2026-71462
Awaiting Analysis Awaiting Analysis - Queue

Path Traversal in Ansible Tower Controller

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: redhat-SADP

Description
StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRET_KEY, k8s service-account token, receptor sockets, ConfigMap mount points. Mainly impactful on managed AAP (ansiblecloud.com) where tenant admin != host admin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-71462
EUVD
EUVD-2026-85536

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
red_hat ansible_automation_platform *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-204 The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-71462 is a security flaw in Red Hat Ansible Automation Platform where the StringListPathField.to_internal_value() function checks user-supplied paths using os.path.exists() without proper validation. A superuser can exploit HTTP response codes (200 vs 400) to determine if arbitrary absolute paths exist on the controller-web pod, potentially revealing sensitive files like secret keys or Kubernetes tokens.

Detection Guidance

Monitor HTTP response codes (200 vs 400) for requests involving CUSTOM_VENV_PATH or path validation endpoints. Check for unusual access patterns to sensitive paths like /etc/tower/SECRET_KEY or Kubernetes tokens. Use network traffic analysis to detect path enumeration attempts.

Impact Analysis

If you are a tenant superuser in a managed Ansible Automation Platform (AAP) environment, this vulnerability allows you to check for the existence of sensitive files such as /etc/tower/SECRET_KEY, Kubernetes service-account tokens, receptor sockets, or ConfigMap mount points. This could lead to information disclosure but requires superuser access to exploit.

Mitigation Strategies

Restrict superuser privileges to prevent path enumeration. Apply patches or updates from Red Hat once available. Monitor Red Hat advisories for official mitigations. Disable or restrict CUSTOM_VENV_PATH functionality if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71462. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart