CVE-2026-66804

A flaw was found in the console component. An authenticated user can exploit a Server-Side Request Forgery SSRF vulnerability by manipulating the towerHost parameter when accessing the /ansibletower handler. This allows the user to bypass pathname validation and access arbitrary internal or...