CVE-2026-71461 is a vulnerability in Red Hat Ansible Automation Platform
Published on September 23, 2026
Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler
HostList.list() catches bare Exception and returns str(e)
verbatim. Via host_filter, any authenticated user triggers
Django FieldError (leaking complete Host model relation
graph including internal reverse accessors) or PostgreSQL
DataError (leaking raw database error strings). Two
primitives: credential__search=x dumps ORM schema,
name__regex=[bad reflects PostgreSQL errors.
Vulnerability Analysis
CVE-2026-71461 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Timeline
Reported to Red Hat.
Made public. 31 days later.
Weakness Type
Generation of Error Message Containing Sensitive Information
The software generates an error message that includes sensitive information about its environment, users, or associated data.
Products Associated with CVE-2026-71461
Want to know whenever a new CVE is published for Red Hat Ansible Automation Platform? stack.watch will email you.