Ansible Automation Platform CVE-2026-71458

Requires an authenticated account with at least low-privilege access to the platform (PR:L) and is only meaningful on multi-tenant AAP deployments where the attacker's tenant should be isolated from the resources being enumerated. The specific trigger is the URLModificationMiddleware named-URL resolution path, which queries unfiltered Model.objects before RBAC enforcement; the 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path returning a distinguishable 'Not found.' detail string versus 'No <Model> matches...'. Exploitation is limited to information disclosure (existence of named orgs, credentials, inventories, hosts and internal hostnames) - no resource contents, modification, or availability impact. It does not require user interaction or elevated privileges, but yields value only against a shared/multi-tenant configuration.

This is a genuinely low-priority issue whose signals are internally consistent rather than conflicting. The vendor CVSS of 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) describes a network-reachable, low-complexity flaw requiring an authenticated low-privilege account, producing only limited confidentiality impact (C:L) with a scope change (S:C) because one tenant learns of resources belonging to another. The CWE-204 (Observable Response Discrepancy) classification matches the description precisely: the vulnerability is an information oracle, not a code-execution or data-dumping bug. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' There is no signal conflict here - the description (differential 404 detail strings revealing resource existence) fully supports the low C:L rating and the S:C cross-tenant scope. The realistic priority is low: an attacker gains only enumeration/reconnaissance value (confirming existence of named orgs, credentials, inventories, hosts, and internal hostnames), not their contents. It is a defense-in-depth / multi-tenant-isolation hardening fix rather than an urgent patch, though multi-tenant AAP operators hosting mutually distrusting tenants should prioritize it higher than single-tenant deployments.

An authenticated low-privilege user on a shared Ansible Automation Platform instance issues named-URL lookups (e.g., for an org, credential, inventory, or host) they have no RBAC access to, then compares the returned 404 detail string - 'Not found.' versus 'No <Model> matches...' - to infer whether the named resource exists anywhere on the platform. By iterating across candidate names, the attacker enumerates internal hostnames and resource inventories belonging to other tenants. No public exploit code was identified, but the technique is trivially scriptable given the described response differential.