CVE-2026-71462 Red Hat CVE debrief

Who should care

Defenders responsible for managing Red Hat Ansible Automation Platform instances, especially in managed AAP (ansiblecloud.com) environments where tenant admin != host admin, should assess their exposure to this vulnerability and prioritize patching.

Why it matters

CVE-2026-71462 is a vulnerability in Red Hat Ansible Automation Platform that allows a tenant superuser to confirm the existence of arbitrary absolute paths on the controller-web pod. Defenders should prioritize verifying the existence of this vulnerability in their environment, especially in managed AAP instances, and ensure that the latest patches are applied.

• Verify the existence of sensitive files on the controller-web pod.
• Assess the impact of a potential path-existence oracle on your AAP instances.
• Prioritize patching to prevent potential exploitation attempts.
• Monitor for potential exploitation attempts on your AAP instances.

Technical summary

The custom_venv_path setting in Red Hat Ansible Automation Platform's automation-controller component allows a tenant superuser to confirm the existence of arbitrary absolute paths on the controller-web pod. This is caused by StringListPathField.to_internal_value() calling os.path.exists() on unbounded user-supplied paths. The vulnerability is mainly impactful on managed AAP (ansiblecloud.com) where tenant admin != host admin. A tenant superuser can confirm the existence of sensitive files such as /etc/tower/SECRET_KEY, k8s service-account token, receptor sockets, and ConfigMap mount points.

Defensive priority

Defenders should prioritize verifying the existence of this vulnerability in their environment, especially in managed AAP instances, and ensure that the latest patches are applied.

Recommended defensive actions

• Verify the existence of this vulnerability in your environment, especially in managed AAP instances.
• Ensure that the latest patches are applied to the automation-controller component.
• Monitor for potential exploitation attempts on your AAP instances.
• Restrict access to sensitive files and directories on the controller-web pod.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by StringListPathField.to_internal_value() calling os.path.exists() on unbounded user-supplied paths, which can reveal the existence of arbitrary absolute paths on the controller-web pod. A tenant superuser can confirm the existence of sensitive files such as /etc/tower/SECRET_KEY, k8s service-account token, receptor sockets, and ConfigMap mount points.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.