CVE-2026-71460

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An improper access control issue exists in the '/api/v2/config/' endpoint, which is protected only by the IsAuthenticated permission. This allows any authenticated user to access the license info object, which contains sensitive data such as account number, subscription id, pool id, sku, support level, and instance counts. While a superuser or auditor gate restricts access to project base dir, project local paths, and custom virtualenvs, it does not cover license info. This exposure can be used for estate sizing reconnaissance and social engineering attacks against Red Hat support.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.