CVE-2026-71460
Description
/api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_id, sku, support_level, instance counts) returned to any authenticated user. The superuser/auditor gate only covers project_base_dir/project_local_paths/custom_virtualenvs, not license_info. Enables social engineering against Red Hat support and estate sizing reconnaissance.
Statement
A moderate information disclosure flaw was found in the automation-controller component of Red Hat Ansible Automation Platform. The /api/v2/config/ API endpoint is protected only by authentication, and its response includes the license_info block containing Red Hat subscription and licensing details such as the account number, subscription ID, pool ID, SKU, support level, and instance counts. The existing superuser/auditor gate applied to this endpoint restricts only project_base_dir, project_local_paths, and custom_virtualenvs, and does not cover license_info, so any authenticated user, regardless of assigned privileges, can retrieve this subscription information. Exposure of these details can facilitate social engineering against Red Hat support and estate-sizing reconnaissance, but has no direct impact on integrity or availability. Red Hat assessed the impact as Moderate with a CVSS 4.3 score (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), consistent with the upstream CVE severity. The affected automation-controller packages and controller container images in Ansible Automation Platform are tracked as affected, with resolution delegated to the Ansible product team: a fix is being pursued through the platform update process for the maintained streams, while no fix is planned for the older Ansible Automation Platform 2.4 stream.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.3 | N/A | 4.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Acknowledgements
This issue was discovered by Chris Meyers (Red Hat).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
