CVE-2026-71460 is a vulnerability in Red Hat Ansible Automation Platform
Published on September 23, 2026
Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license details via /config/
/api/v2/config/ is protected only by IsAuthenticated.
license_info (account_number, subscription_id, pool_id,
sku, support_level, instance counts) returned to any
authenticated user. The superuser/auditor gate only covers
project_base_dir/project_local_paths/custom_virtualenvs,
not license_info. Enables social engineering against
Red Hat support and estate sizing reconnaissance.
Vulnerability Analysis
CVE-2026-71460 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Timeline
Reported to Red Hat.
Made public. 31 days later.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-71460 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-71460
Want to know whenever a new CVE is published for Red Hat Ansible Automation Platform? stack.watch will email you.