CVE-2026-71463
Received Received - Intake

Jinja2 Template AST Bypass in Notification System

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: redhat-SADP

Description
Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts (job['job'+'_env']) and {% if job.id > 100 %} conditional gating bypass both the AST check and the test-render (stub has small job.id). At runtime, the gated branch executes and exceptions write full tracebacks into notification body, which is POSTed to attacker-controlled webhook URL. Leaks install paths, Python version, source line numbers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-71463
EUVD
EUVD-2026-85540

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
red_hat ansible_automation_platform From 2.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a Jinja AST whitelist in Red Hat's automation-controller that only checks static Getattr nodes. Attackers can bypass this check using dynamic subscripts like job['job'+'_env'] or conditional gating such as {% if job.id > 100 %}. When exceptions occur during runtime, full tracebacks containing sensitive system details are leaked into notification bodies and sent to attacker-controlled webhook URLs.

Detection Guidance

Check for unauthorized webhook POST requests in network logs containing traceback data. Inspect automation-controller notification templates for dynamic Jinja expressions like job['job'+'_env'] or conditional gating (e.g., {% if job.id > 100 %}).

Review system logs for Python tracebacks in notification bodies. Verify installed Red Hat Ansible Automation Platform versions against patched releases (e.g., 2.6 for RHEL 9/10).

Impact Analysis

An attacker with admin privileges could exploit this to leak sensitive system information like install paths, Python version, and source line numbers. This could aid further attacks or expose internal system details. The impact is limited to confidentiality as the CVSS score indicates low severity.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive system information, potentially violating GDPR or HIPAA requirements for protecting personal or health data. The leakage of install paths and Python versions may indicate insufficient security controls.

Mitigation Strategies

Upgrade to Red Hat Ansible Automation Platform 2.6 for RHEL 9/10 via RHSA-2026:71113. If upgrading is not immediately possible, restrict admin privileges and monitor webhook traffic for suspicious POST requests.

Disable dynamic Jinja expressions in notification templates. Review and sanitize notification bodies to prevent sensitive data leaks. Consult a Technical Account Manager for additional guidance.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71463. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart