CVE-2026-71460: API License Information Disclosure Flaw

CVE-2026-71460 Overview

CVE-2026-71460 is a missing authorization flaw [CWE-862] in the /api/v2/config/ endpoint of a Red Hat product. The endpoint enforces only an IsAuthenticated check, which allows any authenticated user to retrieve license_info data. Exposed fields include account_number, subscription_id, pool_id, sku, support_level, and instance counts. The intended superuser and auditor gate covers project_base_dir, project_local_paths, and custom_virtualenvs, but it does not cover license_info. Attackers can use the leaked identifiers for social engineering against Red Hat support and for reconnaissance of the target's deployment size.

Critical Impact
Any authenticated user can read subscription and license details, enabling support-impersonation attacks and estate sizing.

Affected Products

Red Hat products referenced in Red Hat Security Advisories RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71177, and RHSA-2026:71179
Deployments exposing the /api/v2/config/ REST endpoint
See the Red Hat CVE Analysis CVE-2026-71460 for the authoritative product list

Discovery Timeline

2026-09-23 - CVE-2026-71460 published to the National Vulnerability Database
2026-09-24 - Last updated in the NVD database

Technical Details for CVE-2026-71460

Vulnerability Analysis

The vulnerability is a broken access control weakness in a REST API endpoint. The /api/v2/config/ handler applies the Django REST Framework IsAuthenticated permission class as its only guard. Any account with a valid session or token can call the endpoint and receive the response body. The response includes a license_info object containing subscription metadata that should be restricted to administrative roles. The exposed identifiers support two follow-on attack paths: impersonation of the customer during Red Hat support interactions, and reconnaissance of the deployment footprint using instance counts and SKU data. The issue does not enable code execution, data modification, or availability impact.

Root Cause

The endpoint applies a coarse-grained authorization policy. A superuser and auditor check exists in the handler, but it only wraps project_base_dir, project_local_paths, and custom_virtualenvs. The license_info block sits outside that conditional and is serialized for every authenticated caller. The permission model conflates authentication with authorization, which maps directly to [CWE-862] Missing Authorization.

Attack Vector

An attacker needs valid, low-privileged credentials on the target instance. The attacker sends an authenticated GET request to /api/v2/config/ over the network and parses the returned JSON for the license_info fields. No user interaction, elevated privileges, or specialized tooling is required. The returned account_number, subscription_id, pool_id, and sku values can then be used to craft support-desk pretexts, while support_level and instance counts inform sizing estimates for further intrusion planning.

No verified proof-of-concept code is published for this CVE. Refer to the Red Hat Bugzilla Report #2512369 for reproduction context.

Detection Methods for CVE-2026-71460

Indicators of Compromise

Unexpected GET /api/v2/config/ requests from non-administrative user accounts
API access logs showing license_info field retrieval by users without superuser or auditor roles
Support tickets referencing accurate account_number or subscription_id values that were not provided through official channels

Detection Strategies

Audit application access logs for calls to /api/v2/config/ and correlate the calling identity against role assignments
Alert on API responses where license_info is served to users lacking administrative privileges
Baseline normal callers of the configuration endpoint and flag deviations, especially service or read-only accounts issuing the request

Monitoring Recommendations

Forward reverse-proxy and application logs to a centralized analytics platform for retention and query
Enable API-level auditing that records request path, authenticated principal, and response schema
Review Red Hat support interactions for unusual identity verification attempts referencing subscription identifiers

How to Mitigate CVE-2026-71460

Immediate Actions Required

Apply the Red Hat updates referenced in RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71177, and RHSA-2026:71179
Rotate any subscription identifiers that may have been exposed to non-administrative users
Review account membership and remove unnecessary low-privileged users from the affected instance

Patch Information

Red Hat has published fixes through the errata listed above. The corrective patch extends the superuser and auditor authorization gate to include the license_info block, so only administrative roles receive the sensitive fields. Consult the Red Hat CVE Analysis CVE-2026-71460 page for the mapping between advisory and fixed package version.

Workarounds

Restrict network reachability of /api/v2/config/ to administrative networks using a reverse proxy or web application firewall rule
Reduce the number of accounts with API access until the patch is deployed
Instruct Red Hat support to enforce additional identity verification beyond subscription identifiers when handling account requests

bash

# Example NGINX rule restricting the endpoint to an admin subnet
location = /api/v2/config/ {
    allow 10.0.10.0/24;
    deny all;
    proxy_pass http://backend;
}