CVE-2026-71462: Path Existence Disclosure Vulnerability

CVE-2026-71462 Overview

CVE-2026-71462 is an information disclosure vulnerability in the StringListPathField.to_internal_value() method used within Red Hat Ansible Automation Platform (AAP). The method calls os.path.exists() on unbounded, user-supplied absolute paths. The API returns HTTP 200 or HTTP 400 depending on whether the referenced path exists on the controller-web pod, creating a response-based oracle [CWE-204].

A tenant superuser can enumerate arbitrary filesystem locations, including /etc/tower/SECRET_KEY, Kubernetes service-account tokens, receptor sockets, and ConfigMap mount points. The impact is most pronounced on managed Ansible Automation Platform deployments (ansiblecloud.com) where tenant administrators are distinct from host administrators.

Critical Impact
Authenticated tenant superusers can confirm the presence of sensitive host-level files on shared multi-tenant AAP controllers, enabling reconnaissance for further attacks.

Affected Products

Red Hat Ansible Automation Platform (managed AAP / ansiblecloud.com)
Red Hat Ansible Automation Platform controller-web component
Related components covered by RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71177, and RHSA-2026:71179

Discovery Timeline

2026-09-23 - CVE-2026-71462 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-71462

Vulnerability Analysis

The vulnerability resides in the StringListPathField serializer field within the AAP controller. When a request supplies a list of paths, to_internal_value() iterates over each entry and invokes os.path.exists() without validating that the paths fall within an allow-listed directory or belong to the requesting tenant.

The controller responds with HTTP 200 when validation succeeds and HTTP 400 when a path does not exist. This differential response is observable to any authenticated client and constitutes a response discrepancy oracle. An attacker uses the oracle to test the presence of any absolute path readable by the controller-web process.

Because the check runs inside the pod's filesystem namespace, the oracle exposes cluster-level artifacts. Sensitive targets include /etc/tower/SECRET_KEY, /var/run/secrets/kubernetes.io/serviceaccount/token, receptor UNIX domain sockets, and ConfigMap mount paths under /etc/.

Root Cause

The root cause is missing authorization and input validation on the path field. The serializer trusts caller-supplied absolute paths and probes the local filesystem without confining the lookup to a tenant-scoped root. The distinct 200 versus 400 response codes then leak the boolean existence result back to the caller.

Attack Vector

Exploitation requires an authenticated tenant superuser session against the AAP controller API. The attacker submits crafted payloads containing candidate absolute paths and observes the HTTP status. Iterating through a wordlist of Kubernetes secret locations, application configuration files, and socket paths yields a map of files present on the shared controller pod. No user interaction is required, and the flaw crosses the tenant-to-host trust boundary on managed AAP.

No verified proof-of-concept code is publicly available. See the Red Hat CVE Details for CVE-2026-71462 and Red Hat Bug Report #2512371 for vendor-supplied technical context.

Detection Methods for CVE-2026-71462

Indicators of Compromise

Repeated authenticated API requests from a single tenant containing serializer fields backed by StringListPathField with absolute paths such as /etc/tower/SECRET_KEY or /var/run/secrets/....
Bursts of HTTP 400 responses interleaved with HTTP 200 responses on the same endpoint from one principal, consistent with path enumeration.
Requests referencing Kubernetes service-account token paths, receptor sockets, or ConfigMap mount points originating from tenant-scoped accounts.

Detection Strategies

Alert on any authenticated request whose payload contains absolute paths outside the tenant's expected project or inventory scope.
Correlate 200/400 response ratios per user and endpoint to identify oracle-style probing behavior.
Baseline normal serializer input for path-typed fields and flag deviations that reference system directories (/etc, /proc, /var/run/secrets).

Monitoring Recommendations

Ingest AAP controller access logs and Kubernetes audit logs into a centralized analytics platform for correlation across tenants.
Monitor controller-web pod logs for anomalous os.path.exists call patterns tied to a single API session.
Track privileged tenant superuser activity on managed AAP tenants and review any access to path-accepting endpoints.

How to Mitigate CVE-2026-71462

Immediate Actions Required

Apply the Red Hat security updates referenced in RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71177, and RHSA-2026:71179 to all AAP controller instances.
Audit tenant superuser accounts on managed AAP and revoke unnecessary elevated privileges.
Rotate any secrets that a tenant superuser could have located, including /etc/tower/SECRET_KEY and Kubernetes service-account tokens exposed to the controller-web pod.

Patch Information

Red Hat has released fixed packages via multiple advisories. Refer to RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71177, and RHSA-2026:71179 for package versions and applicability. The fix constrains StringListPathField.to_internal_value() so it no longer probes arbitrary filesystem paths on behalf of unauthenticated tenant input.

Workarounds

Restrict tenant superuser role assignments on managed AAP until the patch is deployed.
Place a reverse-proxy or API gateway rule in front of the controller to reject request bodies containing absolute paths targeting sensitive directories (/etc, /var/run/secrets, /proc).
Normalize error responses at the proxy layer so that 200 and 400 responses on affected endpoints do not reveal existence information.

bash

# Example proxy rule concept - reject payloads referencing sensitive host paths
# (Adapt to your API gateway or WAF policy language)
if request.body matches "/etc/tower/|/var/run/secrets/|/proc/":
    deny with 403