Internal Hostname Enumeration in Red Hat Products
CVE-2026-71458
5MEDIUM
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 23 September 2026
What is CVE-2026-71458?
A vulnerability exists in Red Hat systems where the URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects prior to enforcing Role-Based Access Control (RBAC). This flaw can lead to leakage of information during error handling, as the system may return different 404 detail strings depending on the existence of named resources across different tenants. As a result, attackers can utilize this distinction to enumerate internal hostnames and resources, potentially compromising the security of tenant data.
Affected Version(s)
Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:4.6.33-1.el8ap
Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:4.6.33-1.el9ap
Red Hat Ansible Automation Platform 2.6 1789673739