CVE-2026-71461 Overview
CVE-2026-71461 is an information disclosure vulnerability in the HostList.list() API endpoint. The function catches a bare Exception and returns str(e) verbatim to the caller. Authenticated users can abuse the host_filter parameter to trigger Django FieldError exceptions that leak the complete Host model relation graph, including internal reverse accessors. A second primitive uses PostgreSQL DataError exceptions to reflect raw database error strings back to the attacker. The flaw is categorized under [CWE-209] Generation of Error Message Containing Sensitive Information.
Critical Impact
Any authenticated low-privilege user can enumerate internal ORM schema and database internals through crafted filter parameters.
Affected Products
- Red Hat product ecosystem (see Red Hat CVE Report CVE-2026-71461)
- Applications shipping the vulnerable HostList.list() implementation
- Deployments backed by PostgreSQL exposing the host_filter parameter
Discovery Timeline
- 2026-09-23 - CVE CVE-2026-71461 published to NVD
- 2026-09-24 - Last updated in NVD database
Technical Details for CVE-2026-71461
Vulnerability Analysis
The root defect is an overly broad exception handler in HostList.list(). The handler catches bare Exception and returns the stringified exception message directly in the API response. This converts internal error diagnostics into an attacker-controlled information oracle.
Two exploitation primitives are documented. The first uses credential__search=x, which triggers a Django FieldError. The resulting error string enumerates every valid relation on the Host model, including internal reverse accessors that are not part of the public API. The second uses name__regex=[bad, an invalid regular expression that PostgreSQL rejects with a DataError. The raw database error is reflected verbatim to the attacker.
Exploitation requires only an authenticated session with permission to call the list endpoint. Repeated probing enables an attacker to map the ORM object graph, identify hidden relationships, and gather intelligence useful for chaining further attacks against the application or database.
Root Cause
The HostList.list() method wraps filter processing in a broad try/except Exception block. Instead of logging the exception and returning a sanitized error, the handler returns str(e) to the client. Django and PostgreSQL exceptions include structured diagnostic content that is safe for server logs but not for external responses.
Attack Vector
An authenticated attacker issues HTTP requests to the list endpoint with a crafted host_filter value. Setting credential__search=x forces Django to raise a FieldError listing all valid model fields and reverse relations. Setting name__regex=[bad produces a PostgreSQL regex parse failure that leaks database error internals. The vulnerability is described in the Red Hat Bug Report #2512370.
Detection Methods for CVE-2026-71461
Indicators of Compromise
- Requests containing host_filter parameters with suffixes such as __search, __regex, or unknown relation names
- HTTP 400 or 500 responses whose bodies contain Django FieldError text or PostgreSQL error strings
- Repeated authenticated probing of the list endpoint from a single principal within a short window
Detection Strategies
- Inspect application logs for FieldError and DataError exception traces originating in HostList.list()
- Alert on outbound API responses containing ORM field names, reverse accessor names, or PostgreSQL diagnostic tokens
- Correlate authenticated user IDs with high volumes of malformed host_filter values
Monitoring Recommendations
- Enable structured logging on the list endpoint and forward events to a SIEM for correlation
- Baseline normal host_filter values per user role and flag statistical outliers
- Add web application firewall rules that inspect responses for schema-like content
How to Mitigate CVE-2026-71461
Immediate Actions Required
- Apply the vendor update referenced in Red Hat Security Advisory RHSA-2026:71177
- Restrict access to the list endpoint to accounts that require it
- Review audit logs for prior abuse of credential__search and name__regex filter values
Patch Information
Red Hat has published fixes tracked under Red Hat Security Advisory RHSA-2026:71177. Consult the Red Hat CVE Report CVE-2026-71461 for the authoritative list of affected package versions and remediation guidance.
Workarounds
- Deploy a reverse proxy or WAF rule that strips exception details from responses on the list endpoint
- Add an allowlist of permitted host_filter keys and reject requests using unknown suffixes such as __search or __regex
- Wrap the endpoint in a middleware that returns generic error messages while preserving detailed logs server-side
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.