2 matches found
EUVD-2026-85536
StringListPathField.tointernalvalue calls os.path.exists on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRETKEY, k8s service-account token, receptor sockets, ConfigMap mount...
4.1CVSS5.9AI score0.00255EPSS
SaveExploits0References3
CVE-2026-71462: Observable Response Discrepancy
StringListPathField.tointernalvalue calls os.path.exists on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRETKEY, k8s service-account token, receptor sockets, ConfigMap mount...
4.1CVSS5.9AI score0.00255EPSS
SaveExploits0References2
20