CVE-2026-71458: URLModificationMiddleware Info Disclosure

CVE-2026-71458 Overview

CVE-2026-71458 is an information disclosure vulnerability in the URLModificationMiddleware component, which resolves named-URL lookups against unfiltered Model.objects before role-based access control (RBAC) enforcement. The middleware's 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path returning a different 404 detail string. Attackers can distinguish between "Not found." and "No <Model> matches..." responses to determine whether named resources such as organizations, credentials, inventories, or hosts exist anywhere on the platform. The flaw enables cross-tenant enumeration of internal hostnames and resource identifiers by authenticated low-privilege users. This weakness maps to [CWE-204: Observable Response Discrepancy].

Critical Impact

Authenticated low-privilege users can enumerate the existence of named resources across tenants they do not own, exposing internal hostnames, credential names, inventory names, and organization identifiers.

Affected Products

• Products referenced by Red Hat Security Advisory RHSA-2026:71113
• Products referenced by Red Hat Security Advisory RHSA-2026:71114
• Products referenced by Red Hat Security Advisories RHSA-2026:71177 and RHSA-2026:71179

Discovery Timeline

• 2026-09-23 - CVE-2026-71458 published to NVD
• 2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-71458

Vulnerability Analysis

The vulnerability resides in URLModificationMiddleware, which resolves named-URL lookups by querying the unfiltered Model.objects manager before the RBAC layer evaluates whether the requesting principal is authorized to access the target resource. The middleware includes a 403→404 shim that rewrites forbidden responses to not-found responses to prevent existence disclosure. However, the shim only rewrites HTTP 403 outcomes and does not normalize the response body returned when the lookup uses a sentinel primary key such as pk=0. Two different 404 response bodies therefore leak state: "Not found." indicates the sentinel or missing pk path, while "No <Model> matches the given query." indicates the resource exists but is out of scope for the caller. An authenticated user can iterate candidate names against endpoints for organizations, credentials, inventories, and hosts and infer cross-tenant existence from the response body alone.

Root Cause

The root cause is an ordering defect: name resolution occurs against an unscoped queryset before RBAC filtering. Compounding this, the response normalization shim is incomplete, covering only the 403 branch and not the sentinel-lookup 404 branch, producing an observable response discrepancy suitable for oracle-style enumeration.

Attack Vector

Exploitation requires network access to the application and valid low-privilege credentials. An attacker issues authenticated requests to named-resource endpoints while varying the resource name and comparing the returned 404 detail strings. Distinct response bodies allow the attacker to confirm the presence of specific organizations, credentials, inventories, or hostnames belonging to other tenants without any read authorization on those objects.

No verified proof-of-concept code is published for CVE-2026-71458.
See the Red Hat CVE analysis and referenced advisories for technical details.

Detection Methods for CVE-2026-71458

Indicators of Compromise

• High volumes of authenticated GET requests against named-resource endpoints (organizations, credentials, inventories, hosts) from a single principal or session.
• Sequential requests that iterate candidate resource names or hostnames, particularly against endpoints that return HTTP 404.
• Repeated 404 responses with alternating "Not found." and "No <Model> matches the given query." bodies from the same source.

Detection Strategies

• Baseline per-user request rates to named-resource endpoints and alert on statistically significant deviations.
• Parse application response bodies in access logs to distinguish the two 404 detail strings and correlate ratios per user.
• Alert on authenticated users generating 404 responses for resources outside their tenant or organization scope.

Monitoring Recommendations

• Forward application access logs and response bodies to a central analytics platform for cross-tenant correlation.
• Track named-URL lookup patterns per session, tenant, and user role.
• Review RBAC audit logs for principals accessing named endpoints across tenant boundaries.

How to Mitigate CVE-2026-71458

Immediate Actions Required

• Apply the vendor patches referenced in Red Hat Security Advisory RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71177, and RHSA-2026:71179.
• Audit named resources such as hostnames, credential names, and organization slugs for sensitive strings that could aid an attacker if enumerated.
• Rotate any credentials whose names may themselves disclose infrastructure details.

Patch Information

Red Hat has published fixed packages in the advisories listed above. Refer to the Red Hat CVE Analysis for CVE-2026-71458 and Red Hat Bug Report #2512367 for affected component versions and remediation guidance.

Workarounds

• Restrict access to named-resource endpoints to trusted networks or authenticated administrators until patches are applied.
• Deploy a reverse-proxy or WAF rule that normalizes 404 response bodies from affected endpoints to a single generic string.
• Rate-limit authenticated requests to named-URL endpoints to slow enumeration attempts.

# Example WAF response-body normalization pattern (pseudocode)
# Rewrite any 404 body containing "No <Model> matches" to "Not found."
if response.status == 404 and response.body matches /No .* matches the given query/:
    response.body = '{"detail":"Not found."}'