Unbounded User-Supplied Path Vulnerability in Ansible Automation Platform by Red Hat
CVE-2026-71462
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 23 September 2026
What is CVE-2026-71462?
This vulnerability allows for potential exposure of sensitive information due to inadequate validation of user-supplied paths in the Ansible Automation Platform. The method StringListPathField.to_internal_value() inappropriately calls os.path.exists() on unrestricted paths, which enables attackers to verify the existence of critical files like /etc/tower/SECRET_KEY and Kubernetes tokens. This flaw predominantly affects managed environments, where the privileges of the tenant administrator do not align with those of the host administrator, making it easier to exploit for unintended disclosures.
Affected Version(s)
Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:4.6.33-1.el8ap
Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:4.6.33-1.el9ap
Red Hat Ansible Automation Platform 2.6 1789673739