CVE-2026-71463

Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts job'job'+'env' and % if job.id 100 % conditional gating bypass both the AST check and the test-render stub has small job.id. At runtime, the gated branch executes and exceptions write full tracebacks...

CVE-2026-71463

The Red Hat Ansible Automation Platform (specifically the automation-controller component) is vulnerable to stack trace disclosure due to a Jinja AST whitelist bypass . The whitelist only inspects static Getattr nodes, allowing dynamic subscripts (e.g., job['job'+'_env']) and conditional gating (...

CVE-2026-71463

Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts job'job'+'env' and % if job.id 100 % conditional gating bypass both the AST check and the test-render stub has small job.id. At runtime, the gated branch executes and exceptions write full tracebacks...

CVE-2026-71463: Generation of Error Message Containing Sensitive Information

Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts job'job'+'env' and % if job.id 100 % conditional gating bypass both the AST check and the test-render stub has small job.id. At runtime, the gated branch executes and exceptions write full tracebacks...