cyfenced.com →

[ CVE-2026-71460 · Published 23 Sep 2026 ]

Vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8

CVSS 4.3 EPSS <1%1 agency advisoryNo fix listed yet

[ Description ]Official description

/api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_id, sku, support_level, instance counts) returned to any authenticated user. The superuser/auditor gate only covers project_base_dir/project_local_paths/custom_virtualenvs, not license_info. Enables social engineering against Red Hat support and estate sizing reconnaissance.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

[ References ]References