Information Disclosure in Red Hat Software Regarding License Information
CVE-2026-71460

4.3MEDIUM

Key Information:

Vendor: Red Hat
Status: Red Hat Ansible Automation Platform 2.5 For Rhel 8; Red Hat Ansible Automation Platform 2.5 For Rhel 9; Red Hat Ansible Automation Platform 2.6 For Rhel 9; Red Hat Ansible Automation Platform 2.6
Vendor: CVE Published:; 23 September 2026

What is CVE-2026-71460?

A security vulnerability exists in Red Hat software where the endpoint /api/v2/config/ is only protected by user authentication. This allows any authenticated user to access sensitive license information, including account number, subscription ID, pool ID, SKU, support level, and instance counts. The lack of adequate protection exposes Red Hat's clients to potential social engineering attacks and enables unauthorized estate sizing reconnaissance, as the superuser/auditor protections do not extend to the license information data.