{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.6.33-1.el8ap","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.6.33-1.el9ap","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.7.17-1.el9ap","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","product":"Red Hat Ansible Automation Platform 2.6","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1789673739","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","product":"Red Hat Ansible Automation Platform 2.7","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1789580684","versionType":"rpm"}]}],"cveId":"CVE-2026-71462","cwes":["CWE-204"],"description":"StringListPathField.to_internal_value() calls\n              os.path.exists() on unbounded user-supplied paths.\n              200 vs 400 response reveals existence of arbitrary\n              absolute paths on the controller-web pod. Tenant\n              superuser can confirm /etc/tower/SECRET_KEY, k8s\n              service-account token, receptor sockets, ConfigMap\n              mount points. Mainly impactful on managed AAP\n              (ansiblecloud.com) where tenant admin != host admin.","epss":{"date":"2026-11-05","percentile":0.17166,"score":0.00255},"exploits":[],"kev":null,"metrics":[{"score":4.1,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1793919178418,"publishedAt":1790187922490,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:71113"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:71114"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:71177"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:71179"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-71462"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512371"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"revision":"31bdb98871369d451ae996d12bb2fab11e3a2b59f8da02130d5bc749690fcc39","sources":[{"modifiedAt":1793919178418,"name":"CNA: redhat","retrievedAt":1793920167941,"url":"https://www.cve.org/CVERecord?id=CVE-2026-71462"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793920182240,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-71462"}],"ssvc":{"assessedAt":1790191880113,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control pod","updatedAt":1793920182240}