Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler
10Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.3
exploitation probability
—
observed exploitation
nono source reports it
HostList.list() catches bare Exception and returns str(e)
verbatim. Via host_filter, any authenticated user triggers
Django FieldError (leaking complete Host model relation
graph including internal reverse accessors) or PostgreSQL
DataError (leaking raw database error strings). Two
primitives: credential__search=x dumps ORM schema,
name__regex=[bad reflects PostgreSQL errors.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
Red Hat · Red Hat Ansible Automation Platform 2