CVE-2026-71462

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. (affected versions not specified)

Description The to internal value() function in StringListPathField calls os.path.exists() using unbounded paths supplied by the user. This allows a tenant superuser to determine the existence of arbitrary absolute paths on the controller-web pod by observing the difference between 200 and 400 HTTP responses. This can be used to confirm the presence of sensitive files such as /etc/tower/SECRET KEY, Kubernetes service-account tokens, receptor sockets, and ConfigMap mount points. This issue is primarily impactful on managed Ansible Automation Platform (AAP) environments where the tenant administrator is not the host administrator.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.