CVE-2026-71458 in Ansible Automation Platform
Summary
by MITRE • 09/23/2026
URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. Differential "Not found." vs "No <Model> matches..." reveals whether a named resource (org, credential, inventory, host) exists anywhere on the platform. Enables cross-tenant internal hostname enumeration.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability described involves a critical flaw in the URL resolution logic within the application's middleware layer, specifically affecting how named URLs are processed relative to Role-Based Access Control checks. The core issue stems from the execution order of operations during request handling. When a user attempts to access a resource via its name rather than its primary key identifier, the system performs an initial database lookup against all available models before enforcing RBAC policies. This premature query allows the application to determine the existence of specific resources across different tenants or organizational units without first verifying if the requesting user has permission to view them.
This architectural flaw creates a significant information disclosure vector known as cross-tenant enumeration. Because the middleware resolves named URLs against unfiltered data, it can distinguish between two distinct types of not-found scenarios based on the HTTP response details. If a resource does not exist anywhere in the system, the application returns a generic forty-four hundred status code with a detail message stating "Not found." However, if the resource exists but is inaccessible due to lack of permissions or because it belongs to another tenant, the initial lookup succeeds, leading to a forbidden error that is subsequently shimmed into a forty-four hundred response. Crucially, this shimmed response retains specific details such as "No <Model> matches...", which differs from the generic message used for non-existent resources.
An attacker can exploit this differential behavior by systematically probing various named URLs associated with sensitive entities like organizations, credentials, inventories, and hosts. By analyzing whether the returned forty-four hundred error contains the generic text or the specific model-matching text, an adversary can confirm the existence of these internal assets even if they cannot access them directly. This capability effectively bypasses isolation boundaries between tenants, allowing for the enumeration of internal hostnames and resource structures within a multi-tenant environment. Such information gathering is often a precursor to more severe attacks, including targeted privilege escalation or lateral movement within the infrastructure.
From a classification perspective, this vulnerability aligns with CWE-209, which covers the generation of an error message that reveals sensitive information, as well as CWE-614, concerning session side issues related to insufficient control over security-relevant data flow. In terms of attack patterns, it maps directly to ATT&CK technique T1589.002, specifically Credential or Password Guessing via enumeration techniques, although in this context, the target is resource existence rather than credentials per se. It also relates to T1046, Network Service Discovery, as the attacker discovers valid network resources and their associated metadata through HTTP response analysis.
To mitigate this vulnerability, developers must ensure that access control checks are performed before any database queries that could reveal information about existing objects. The middleware should validate RBAC permissions for a requested resource based on its identifier or context prior to executing lookups against the full dataset. Alternatively, if name-based resolution is required, the system should return uniform error responses regardless of whether the object exists but is inaccessible versus not existing at all. Implementing consistent forty-four hundred responses with identical detail strings eliminates the differential signal that attackers rely upon for enumeration. Additionally, logging and monitoring mechanisms should be enhanced to detect patterns indicative of systematic probing against named URL endpoints, providing an early warning system for such reconnaissance activities.