CVE-2026-71462 in Ansible Automation Platform
Summary
by MITRE • 09/23/2026
StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRET_KEY, k8s service-account token, receptor sockets, ConfigMap mount points. Mainly impactful on managed AAP (ansiblecloud.com) where tenant admin != host admin.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified involves a path traversal flaw within the StringListPathField.to_internal_value() method of the controller-web application component in Ansible Automation Platform. This function is responsible for processing user-supplied input that defines file system paths, yet it fails to adequately sanitize or validate these inputs before passing them to the os.path.exists() function. The core technical deficiency lies in the lack of bounds checking on the length and structure of the provided path strings, allowing an attacker to supply arbitrarily long absolute paths rather than restricted relative ones. This oversight enables the application to perform file system existence checks against any location accessible by the web server process, effectively turning a simple input validation routine into a powerful information disclosure vector.
The operational impact of this flaw is significant because it allows for remote enumeration of arbitrary files and directories on the host machine running the controller-web pod. By observing HTTP response codes, specifically distinguishing between 200 OK responses that indicate file existence and 400 Bad Request or similar errors that suggest non-existence, an attacker can systematically probe the file system. This side-channel information leak is particularly dangerous in managed Ansible Automation Platform environments where tenant administrators do not possess host-level administrative privileges but may have elevated permissions within the application itself. The ability to confirm the existence of sensitive configuration files and security artifacts compromises the isolation boundaries intended between tenants and the underlying infrastructure.
Specifically, this vulnerability facilitates the confirmation of critical secrets and credentials stored on the system. An attacker can verify the presence of /etc/tower/SECRET_KEY, which is essential for decrypting encrypted variables within Ansible Vault, thereby undermining data confidentiality at rest. Furthermore, the ability to detect Kubernetes service account tokens mounted into the pod allows an adversary to potentially access cluster resources if those tokens are also exfiltrated through other means or if local file read vulnerabilities exist elsewhere in the stack. The detection of receptor sockets and ConfigMap mount points provides valuable reconnaissance data regarding the internal architecture and communication channels used by the automation controller, aiding further exploitation attempts against related components like Receptor nodes.
This issue aligns with CWE-20 Improper Input Validation and CWE-284 Improper Access Control, as it stems from a failure to restrict user input to expected formats and allows unauthorized access to system information. In terms of the MITRE ATT&CK framework, this behavior corresponds to T1537 Transfer Data to Cloud Account or Local File Exfiltration via Information Discovery techniques, specifically leveraging file existence checks for reconnaissance. The vulnerability is most critical in multi-tenant deployments where privilege escalation from tenant admin to host admin is not possible through standard means, yet the application inadvertently provides a bridge to gather intelligence that could support more advanced attacks such as credential stuffing or lateral movement within the Kubernetes cluster if combined with other vulnerabilities.
Mitigation strategies should prioritize immediate patching of the controller-web component to versions where StringListPathField properly validates and restricts path inputs to allowed directories only, preventing absolute path traversal entirely. Input validation must enforce strict allow-listing of permitted characters and ensure that all paths are resolved relative to a designated base directory before any file system operations occur. Additionally, implementing robust logging and monitoring for unusual patterns in HTTP response codes related to path parameters can help detect exploitation attempts in real-time. Security teams should also review access controls around the API endpoints involved to ensure that only authorized roles can trigger these validation routines, reducing the attack surface available to tenant administrators who do not require such privileges.