Ansible Automation Platform CVE-2026-71462

Requires an authenticated tenant superuser account (PR:H) on Red Hat Ansible Automation Platform 2 / automation-controller; exploitation is performed by supplying absolute filesystem paths to an API field backed by StringListPathField, whose to_internal_value() invokes os.path.exists() on the unbounded input. The oracle is meaningfully impactful ONLY in the managed AAP deployment mode (ansiblecloud.com) where a tenant administrator is NOT the host administrator, so the disclosed host/pod paths are outside the tenant's legitimate visibility. Limiting factors: high-privilege authentication is required, no host-content is read (existence disclosure only), and on self-managed installs the tenant superuser already has host access, nullifying the boundary crossing.

This is a genuine but low-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N, base 4.1, MEDIUM) accurately captures a narrow information-disclosure oracle: an authenticated tenant superuser (PR:H) submits absolute paths to StringListPathField and infers their existence from a 200-vs-400 response difference (CWE-204 observable response discrepancy). The impact is existence-only (C:L) - the flaw confirms whether a path such as /etc/tower/SECRET_KEY, the k8s service-account token, or receptor sockets exists, but does NOT read their contents; there is no integrity or availability impact (I:N/A:N). No EPSS score, no CISA KEV listing, and no public POC are present in the input, so this is 'no public exploit identified at time of analysis.' The scope-change (S:C) and real-world relevance depend entirely on deployment: it matters only on managed AAP (ansiblecloud.com) where tenant admin != host admin, letting a tenant probe the shared host/pod filesystem. On a self-managed AAP install where the tenant superuser already controls the host, the disclosure is largely moot. There is no conflicting signal here - the CVSS, description, and self-reported vendor scoring align. The key limiter is that this requires high-privilege authentication (tenant superuser), which sharply narrows the attacker population and makes this a reconnaissance aid rather than a standalone breach.

A malicious or compromised tenant superuser on managed AAP (ansiblecloud.com) submits crafted absolute paths through an API field backed by StringListPathField and observes whether each request returns HTTP 200 or 400, using the difference as an existence oracle for host-side files. They enumerate the presence of /etc/tower/SECRET_KEY, the Kubernetes service-account token, receptor sockets, and ConfigMap mount points to map the controller-web pod for a follow-on attack. No public POC is identified; exploitation requires the tenant-superuser privilege level (PR:H) but no user interaction.