REDHAT-BUG-2512369: Medium severity Red Hat Automation Controller vulnerability
A flaw was found in automation-controller. The /api/v2/config/ endpoint returns licenseinfo including Red Hat account number, subscription ID, pool ID, SKU, support level, and instance counts to any authenticated user. The existing superuser/auditor gate only restricts projectbasedir, projectlocalpaths, and customvirtualenvs, but does not cover the licenseinfo block.
Affected Software
Event History
Frequently Asked Questions
Which users can access the exposed licensing information?
Any authenticated user can retrieve the license_info block from the /api/v2/config/ endpoint. The existing superuser/auditor restriction does not apply to that block.
What information may be disclosed?
The exposed license_info data includes the Red Hat account number, subscription ID, pool ID, SKU, support level, and instance counts.
How can an organization determine whether it is affected?
Review access to /api/v2/config/ using a non-privileged authenticated account. If the response includes license_info fields, that account can access the disclosed subscription data.
What updates are associated with this issue?
Red Hat has published RHSA-2026:71113 and RHSA-2026:71114 for this issue. The provided information does not identify the affected or fixed product versions.