Name: CVE-2026-71462: Observable Response Discrepancy
Creator: Rapid7
Published: 2026-09-23T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-71462, CWE-204, CVSS 4.1, EPSS 0.00255

StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRET_KEY, k8s service-account token, receptor sockets, ConfigMap mount points. Mainly impactful on managed AAP (ansiblecloud.com) where tenant admin != host admin.

CVSS Details

CVSS 3.1 Base Score: 4.1
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Redhat_linux	—	Upgrade automation-gateway-configUpgrade python3.12-django-ansible-base+rbacUpgrade receptor-debuginfoUpgrade python3.12-gitpythonUpgrade automation-eda-controller-baseUpgrade automation-eda-controllerUpgrade python3.12-django-ansible-base+feature_flagsUpgrade python3.12-django-ansible-base+rest_filtersUpgrade python3.12-django-ansible-base+authenticationUpgrade receptor-debugsourceUpgrade python3-sqlparseUpgrade python3.12-django-ansible-baseUpgrade python3.12-galaxy-ngUpgrade automation-gateway-proxy-debugsourceUpgrade python3.12-sqlparseUpgrade python3.12-django-ansible-base+channel_authUpgrade automation-eda-controller-base-servicesUpgrade automation-gateway-proxyUpgrade automation-controller-cliUpgrade python3.12-django-ansible-base+resource_registryUpgrade python3.12-django-ansible-base+api_documentationUpgrade automation-controller-uiUpgrade aap-metrics-utilityUpgrade automation-controller-serverUpgrade automation-controllerUpgrade receptorUpgrade automation-platform-uiUpgrade automation-gateway-proxy-server-debuginfoUpgrade receptorctlUpgrade automation-hubUpgrade python3.12-django-ansible-base+redis_clientUpgrade automation-gateway-proxy-serverUpgrade automation-controller-venv-towerUpgrade python3.12-django-ansible-base+jwt_consumerUpgrade automation-eda-controller-event-stream-servicesUpgrade automation-gatewayUpgrade automation-eda-controller-worker-servicesUpgrade python3.12-django-ansible-base+activitystreamUpgrade automation-gateway-serverUpgrade python3.12-django-ansible-base+oauth2_provider	Sep 25, 2026	Sep 6, 2026

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence