CVE-2026-71459: JobJobEventsChildrenSummary Auth Bypass

CVE-2026-71459 Overview

CVE-2026-71459 is a missing authorization flaw [CWE-862] in the JobJobEventsChildrenSummary view of a Red Hat product component. The view does not define a model or parent_model attribute, so ModelAccessPermission.check_get_permissions() falls through and returns True for any authenticated user. The view then calls get_object_or_404(Job, pk) directly without a Django REST Framework (DRF) object-level permission check. A zero-privilege authenticated user can read the event tree structure, retrieve event_processing_finished status, and enumerate Job IDs platform-wide using the HTTP 200 versus 404 response as an oracle.

Critical Impact
Any authenticated low-privilege user can enumerate Job identifiers across tenants and read job event metadata that should be restricted, breaking multi-tenant isolation.

Affected Products

Red Hat product referenced by advisories RHSA-2026:71113 and RHSA-2026:71114
Red Hat product referenced by advisories RHSA-2026:71177 and RHSA-2026:71179
Vendor CVE tracking page: Red Hat CVE Analysis CVE-2026-71459

Discovery Timeline

2026-09-23 - CVE-2026-71459 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-71459

Vulnerability Analysis

The defect is a broken authorization check in a DRF view class. The JobJobEventsChildrenSummary view returns hierarchical summary data for job events associated with a specific Job object. In DRF, permission classes such as ModelAccessPermission typically consult the view's model or parent_model attribute to determine which access rules to evaluate. When both attributes are missing, check_get_permissions() has no policy to enforce and returns True unconditionally.

Because the view then fetches the Job with get_object_or_404(Job, pk), it never invokes check_object_permissions() on the retrieved instance. The result is a broken access control condition where authentication alone grants read access. The sibling endpoint /jobs/{id}/job_events/ performs the correct object-level check and returns HTTP 403 for the same user, confirming the inconsistency is localized to this view.

Root Cause

The root cause is missing model binding on the view class combined with an absent DRF object-level permission invocation. ModelAccessPermission.check_get_permissions() treats a missing model as a no-op and permits the request. This is a classic instance of [CWE-862] Missing Authorization.

Attack Vector

An attacker needs valid credentials for any low-privilege account on the platform. The attacker iterates Job primary keys against the vulnerable endpoint and distinguishes valid from invalid IDs by observing HTTP 200 versus 404 responses. For accessible IDs, the response body discloses the event tree structure and the event_processing_finished field. No user interaction is required, and the request is a single authenticated HTTP GET.

No verified public exploit code is available. The vulnerability mechanism is described in prose per the referenced Red Hat Bug Report #2512368.

Detection Methods for CVE-2026-71459

Indicators of Compromise

Sequential or high-volume HTTP GET requests from a single authenticated session to /jobs/{id}/job_events_children_summary/ across a wide range of Job IDs.
A mixed pattern of HTTP 200 and 404 responses from the same client against the same endpoint, consistent with ID enumeration.
Requests to job_events_children_summary from user accounts that have no legitimate role on the referenced Job objects.

Detection Strategies

Enable application-level access logging on the affected API and alert on per-user request rates that exceed a baseline for the job_events_children_summary route.
Correlate authenticated user identity with the RBAC scope of the accessed Job objects. Flag reads where the user has no direct or inherited role assignment on the target Job.
Compare response codes for the same user across job_events_children_summary and job_events. A 200 on the former while the latter returns 403 indicates active exploitation of the bypass.

Monitoring Recommendations

Ingest reverse-proxy and application logs into a centralized analytics platform and retain them for at least 90 days to support retrospective hunts.
Add a dashboard tracking 404-to-200 ratios per user for the vulnerable endpoint to expose enumeration campaigns early.
Alert on any low-privilege account issuing more than a threshold of Job ID lookups within a short time window.

How to Mitigate CVE-2026-71459

Immediate Actions Required

Apply the vendor-provided updates referenced in RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71177, and RHSA-2026:71179.
Audit recent access logs for the job_events_children_summary endpoint to identify any prior enumeration activity by low-privilege users.
Rotate or review API tokens for accounts that showed anomalous access patterns against the endpoint.

Patch Information

Red Hat has published fixed packages through the errata listed above. Refer to the Red Hat CVE Analysis for CVE-2026-71459 for the authoritative list of impacted packages, fixed versions, and errata mapped to each supported product stream.

Workarounds

Restrict network access to the affected API endpoint at the reverse proxy or ingress layer so only trusted operator networks can reach job_events_children_summary until patches are applied.
Reduce the population of low-privilege authenticated accounts on the platform and disable any unused service or automation accounts.
Enforce stricter RBAC scoping on Job objects and remove unnecessary organization-wide read grants that broaden the impact of the enumeration oracle.

bash

# Example nginx location block to restrict the vulnerable endpoint
# to a trusted management CIDR until patches are deployed
location ~* /api/v2/jobs/[0-9]+/job_events_children_summary/? {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://backend;
}