CVE-2026-71459
Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structure
5.0 Medium
JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through (returns True) for any authenticated user. The view uses raw get_object_or_404(Job, pk) without DRF object-level permission check. Zero-privilege user reads event tree structure, event_processing_finished status, and enumerates Job IDs platform-wide via 200/404 oracle. Sibling endpoint /jobs/{id}/job_events/ correctly returns 403.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
0.28%Unchanged since Sep 24, 2026
What each source reports
CVE List Score used
Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structure
JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through (returns True) for any authenticated user. The view uses raw get_object_or_404(Job, pk) without DRF object-level permission check. Zero-privilege user reads event tree structure, event_processing_finished status, and enumerates Job IDs platform-wide via 200/404 oracle. Sibling endpoint /jobs/{id}/job_events/ correctly returns 403.
- Record
CVE-2026-71459- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-05
EUVDEUVD-2026-85524
JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through (returns True) for any authenticated user. The view uses raw get_object_or_404(Job, pk) without DRF object-level permission check. Zero-privilege user reads event tree structure, event_processing_finished status, and enumerates Job IDs platform-wide via 200/404 oracle. Sibling endpoint /jobs/{id}/job_events/ correctly returns 403.
- Record
EUVD-2026-85524- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-89mc-x55w-mqvp
JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission...
JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through (returns True) for any authenticated user. The view uses raw get_object_or_404(Job, pk) without DRF object-level permission check. Zero-privilege user reads event tree structure, event_processing_finished status, and enumerates Job IDs platform-wide via 200/404 oracle. Sibling endpoint /jobs/{id}/job_events/ correctly returns 403.
- Record
GHSA-89mc-x55w-mqvp- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
NVD
JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through (returns True) for any authenticated user. The view uses raw get_object_or_404(Job, pk) without DRF object-level permission check. Zero-privilege user reads event tree structure, event_processing_finished status, and enumerates Job IDs platform-wide via 200/404 oracle. Sibling endpoint /jobs/{id}/job_events/ correctly returns 403.
- Record
CVE-2026-71459- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-06
OSVRHSA-2026:71113
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Record
RHSA-2026:71113- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:71114
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Record
RHSA-2026:71114- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
receptorRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el10ap | 0:1.6.8-1.el10ap |
receptorRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:2.6.17-3.el9ap | 0:2.6.17-3.el9ap |
receptorRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
python-sqlparseRed Hat:ansible_automation_platform_developer:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
python3-sqlparseRed Hat:ansible_automation_platform_developer:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
python-sqlparseRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
python3-sqlparseRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
Show 28 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python3.12-sqlparseRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
python3.12-sqlparseRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
automation-platform-uiRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:2.6.14-1.el9ap | 0:2.6.14-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-serverRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-uiRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
python3.12-gitpythonRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 61 CVEs |
before 0:3.1.60-1.el9ap | 0:3.1.60-1.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:4.6.33-1.el8ap | 0:4.6.33-1.el8ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:4.6.33-1.el9ap | 0:4.6.33-1.el9ap |
receptorRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el8ap | 0:1.6.8-1.el8ap |
receptorRed Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el8ap | 0:1.6.8-1.el8ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:2.5.10-8.el8ap | 0:2.5.10-8.el8ap |
receptorRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el8ap | 0:1.6.8-1.el8ap |
receptorRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:2.6.17-3.el9ap | 0:2.6.17-3.el9ap |
receptorRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
python3.12-sqlparseRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 57 CVEs |
before 0:0.6.0-1.el8ap | 0:0.6.0-1.el8ap |
python3.12-sqlparseRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:0.6.0-1.el8ap | 0:0.6.0-1.el8ap |
python3.12-sqlparseRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 57 CVEs |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
python3.12-sqlparseRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
automation-gateway-serverRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:2.5.20260923-1.el8ap | 0:2.5.20260923-1.el8ap |
automation-gateway-serverRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:2.5.20260923-1.el9ap | 0:2.5.20260923-1.el9ap |
python3.12-gitpythonRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs |
before 0:3.1.60-1.el8ap | 0:3.1.60-1.el8ap |
python3.12-gitpythonRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs |
before 0:3.1.60-1.el9ap | 0:3.1.60-1.el9ap |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | EUVD, NVD | |
| facts | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-71459 is a medium vulnerability (CVSS 5.0) in Red Hat Ansible Automation Platform 2.5 For Rhel 8, published September 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. No source names a fixed version.
References
access.redhat.com/errata/RHSA-2026:71113
bugzilla.redhat.com/show_bug.cgi?id=2512368
Show 194 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-71459
github.com/advisories/GHSA-89mc-x55w-mqvp
docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71113.json
cve.org/CVERecord?id=CVE-2026-12564
go.dev/cl/814980
groups.google.com/g/golang-announce/c/94pEornpRlI
pkg.go.dev/vuln/GO-2026-5972
vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module
This page doesn't list everything
Left out here: 136 references. The JSON record has them.