Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2026-71461

Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers Django FieldError (leaking complete Host model relation graph including internal reverse accessors) or PostgreSQL DataError (leaking raw database error strings). Two primitives: credential__search=x dumps ORM schema, name__regex=[bad reflects PostgreSQL errors.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Ansible Automation Platform 2.7

Default version status: affected

  • 1789580684 to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2

Default version status: affected

Red Hat Red Hat Ansible Automation Platform 2

Default version status: affected

References