CVE-2026-71462: Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control pod
A flaw was found in automation-controller. The CUSTOMVENVPATHS setting field calls os.path.exists() on user-supplied paths without restriction. A superuser can ▎ determine the existence of arbitrary absolute filesystem paths on the controller-web pod by observing 200 vs 400 responses, enabling discovery of sensitive paths such as secret key files, Kubernetes service-account tokens, and receptor sockets. This is primarily impactful in managed AAP deployments where the tenant superuser is not the infrastructure operator.
Other sources
StringListPathField.tointernalvalue() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRETKEY, k8s service-account token, receptor sockets, ConfigMap mount points. Mainly impactful on managed AAP (ansiblecloud.com) where tenant admin != host admin.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue in practice?
An authenticated automation-controller superuser is required. The main exposure is in managed AAP environments where a tenant superuser is distinct from the infrastructure operator; an administrator who already controls the host has less to gain from the oracle.
What does an attacker need to do to exploit it?
The attacker supplies arbitrary absolute paths through the CUSTOM_VENV_PATHS setting. The response distinguishes existing paths from non-existing paths using 200 versus 400 responses, allowing filesystem path discovery on the controller-web pod.
What information can be exposed?
The issue reveals whether a requested path exists; it does not directly disclose file contents. A superuser can use it to confirm locations of sensitive resources such as /etc/tower/SECRET_KEY, Kubernetes service-account tokens, receptor sockets, and ConfigMap mount points.
How can administrators determine whether they may already be exposed?
Review who has superuser access to automation-controller, especially tenant administrators in managed deployments. The affected behavior is present if submitting an absolute path in CUSTOM_VENV_PATHS produces different 200 and 400 responses depending on whether that path exists on the controller-web pod.