Ansible Automation Platform CVE-2026-71460

Requires a valid authenticated account of any privilege level on the automation-controller (the /api/v2/config/ endpoint enforces only DRF IsAuthenticated). No superuser or auditor role is needed because the license_info portion of the response is not covered by the superuser/auditor gate that protects project_base_dir, project_local_paths, and custom_virtualenvs. No user interaction, special configuration, or non-default deployment mode is required - it affects default configurations. The primary limiting factor is that unauthenticated network attackers cannot reach the data; a login (even a minimal one) is mandatory, and impact is confined to reading commercial license metadata.

This is a genuinely low-priority issue despite carrying a network attack vector. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) is internally consistent with the description: it is a confidentiality-only information-disclosure flaw requiring an authenticated account (PR:L), with no integrity or availability impact and no scope change. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, and no public exploit was identified. The impact is limited to leaking commercial license metadata (account/subscription/pool identifiers, SKU, support level, instance counts) to already-authenticated users - it does not grant new access, credentials, or code execution. The realistic risk is reconnaissance and social-engineering enablement rather than direct compromise; the 'Authentication Bypass' tag overstates it, since exploitation actually REQUIRES a valid authenticated session (CWE-862 broken authorization, not authentication bypass). No signals conflict, and no data indicates elevated real-world urgency.

An attacker with any low-privilege authenticated account on the Ansible Automation Platform controller sends a GET request to /api/v2/config/ and reads the license_info block, which is not covered by the superuser/auditor gate. No public exploit is required - a single authenticated API call returns account_number, subscription_id, pool_id, SKU, support level, and instance counts, which the attacker uses to size the estate and craft convincing social-engineering pretexts against Red Hat support.