Ansible Tower Jinja AST whitelist bypass leaks tracebacks via webhook
CVE-2026-71463 Published on September 23, 2026
Automation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via conditional gating leaks tracebacks
Notification template Jinja AST whitelist only inspects
static Getattr nodes. Dynamic subscripts (job['job'+'_env'])
and {% if job.id > 100 %} conditional gating bypass both
the AST check and the test-render (stub has small job.id).
At runtime, the gated branch executes and exceptions write
full tracebacks into notification body, which is POSTed
to attacker-controlled webhook URL. Leaks install paths,
Python version, source line numbers.
Vulnerability Analysis
CVE-2026-71463 can be exploited with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Timeline
Reported to Red Hat.
Made public. 31 days later.
Weakness Type
Generation of Error Message Containing Sensitive Information
The software generates an error message that includes sensitive information about its environment, users, or associated data.
Products Associated with CVE-2026-71463
Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.
Affected Versions
Red Hat Ansible Automation Platform 2.5 for RHEL 8:- Version 0:4.6.33-1.el8ap and below * is unaffected.
- Version 0:4.6.33-1.el9ap and below * is unaffected.
- Version 0:4.7.17-1.el9ap and below * is unaffected.
- Version 1789673739 and below * is unaffected.
- Version 1789580684 and below * is unaffected.