CVE-2026-71459: Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structure
A flaw was found in automation-controller. The JobJobEventsChildrenSummary view does not declare model or parentmodel attributes, causing ModelAccessPermission.checkgetpermissions() to return True for any authenticated user. An attacker with any valid credential can read job event tree structure and eventprocessingfinished status for arbitrary jobs across all organizations, and enumerate valid job IDs platform-wide via the 200/404 response oracle.
Other sources
JobJobEventsChildrenSummary view has no model/parentmodel. ModelAccessPermission.checkgetpermissions() falls through (returns True) for any authenticated user. The view uses raw getobjector404(Job, pk) without DRF object-level permission check. Zero-privilege user reads event tree structure, eventprocessingfinished status, and enumerates Job IDs platform-wide via 200/404 oracle. Sibling endpoint /jobs/{id}/jobevents/ correctly returns 403.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with a valid credential can exploit it, including a zero-privilege user. The issue permits access across organization boundaries.
What information can an attacker obtain?
An attacker can read job event tree structure and the event_processing_finished status for arbitrary jobs. They can also enumerate valid job IDs across the platform by observing whether requests return 200 or 404.
Is access to the normal job-events endpoint similarly affected?
No. The sibling endpoint /jobs/{id}/job_events/ correctly returns 403, while the affected JobJobEventsChildrenSummary view does not perform the required object-level permission check.
How can I determine whether this endpoint is exposed?
Test the JobJobEventsChildrenSummary endpoint using a low-privilege authenticated account against a job in another organization. A successful response or a 200-versus-404 distinction for arbitrary job IDs indicates the affected authorization behavior.