CVE-2026-71462

Published: Set 23, 2026 Last Modified: Set 24, 2026

ExploitDB:

Other exploit source:

Google Dorks:

MEDIUM 4,1

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: high

User Interaction: none

Scope: changed

Confidentiality: low

Integrity: none

Availability: none

Description

AI Translation Available

StringListPathField.to_internal_value() calls
os.path.exists() on unbounded user-supplied paths.
200 vs 400 response reveals existence of arbitrary
absolute paths on the controller-web pod. Tenant
superuser can confirm /etc/tower/SECRET_KEY, k8s
service-account token, receptor sockets, ConfigMap
mount points. Mainly impactful on managed AAP
(ansiblecloud.com) where tenant admin != host admin.