CVE-2026-71459 is a vulnerability in Red Hat Ansible Automation Platform
Published on September 23, 2026
Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structure
JobJobEventsChildrenSummary view has no model/parent_model.
ModelAccessPermission.check_get_permissions() falls through
(returns True) for any authenticated user. The view uses
raw get_object_or_404(Job, pk) without DRF object-level
permission check. Zero-privilege user reads event tree
structure, event_processing_finished status, and enumerates
Job IDs platform-wide via 200/404 oracle. Sibling endpoint
/jobs/{id}/job_events/ correctly returns 403.
Vulnerability Analysis
CVE-2026-71459 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Timeline
Reported to Red Hat.
Made public. 31 days later.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-71459 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-71459
Want to know whenever a new CVE is published for Red Hat Ansible Automation Platform? stack.watch will email you.