StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRET_KEY, k8s service-account token, receptor sockets, ConfigMap mount points. Mainly impactful on managed AAP (ansiblecloud.com) where tenant admin != host admin.
CVSS Details
- CVSS 3.1 Base Score: 4.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade python3.12-django-ansible-base+jwt_consumerUpgrade python3.12-django-ansible-base+api_documentationUpgrade aap-metrics-utilityUpgrade automation-controller-uiUpgrade python3.12-django-ansible-base+resource_registryUpgrade python3.12-django-ansible-base+redis_clientUpgrade automation-controller-venv-towerUpgrade receptorUpgrade automation-eda-controller-worker-servicesUpgrade automation-gatewayUpgrade python3.12-django-ansible-base+activitystreamUpgrade automation-platform-uiUpgrade automation-eda-controller-event-stream-servicesUpgrade receptorctlUpgrade automation-controller-serverUpgrade automation-controllerUpgrade automation-gateway-proxy-serverUpgrade automation-gateway-proxy-server-debuginfoUpgrade automation-gateway-serverUpgrade automation-hubUpgrade automation-controller-cliUpgrade automation-gateway-proxyUpgrade python3.12-django-ansible-base+channel_authUpgrade python3.12-django-ansible-baseUpgrade python3.12-galaxy-ngUpgrade automation-eda-controller-baseUpgrade automation-eda-controllerUpgrade automation-gateway-proxy-debugsourceUpgrade automation-eda-controller-base-servicesUpgrade receptor-debuginfoUpgrade python3-sqlparseUpgrade python3.12-django-ansible-base+feature_flagsUpgrade python3.12-django-ansible-base+rest_filtersUpgrade python3.12-django-ansible-base+oauth2_providerUpgrade automation-gateway-configUpgrade python3.12-django-ansible-base+rbacUpgrade python3.12-sqlparseUpgrade python3.12-gitpythonUpgrade receptor-debugsourceUpgrade python3.12-django-ansible-base+authentication | Sep 25, 2026 | Sep 6, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub