CVE-2026-71460

Executive Summary

CVE-2026-71460 is a missing authorization vulnerability (CWE-862) affecting an unspecified Red Hat product that exposes a REST configuration endpoint at /api/v2/config/. The endpoint is protected only by an IsAuthenticated permission class, meaning any authenticated user—regardless of privilege level—can retrieve sensitive license_info data including account numbers, subscription IDs, pool IDs, SKUs, support levels, and instance counts. This information disclosure enables social engineering attacks against Red Hat support and provides reconnaissance for estate sizing, with a CVSS v3.1 base score of 4.3.

Technical Analysis

The vulnerability resides in the authorization model of the /api/v2/config/ API endpoint. According to the NVD description, this endpoint is guarded solely by IsAuthenticated, an authentication gate that verifies a request originates from a valid, logged-in user but does not evaluate that user's role, group membership, or permission set. As a result, the principle of least privilege is violated: any account capable of authenticating to the application can invoke the endpoint irrespective of administrative or auditor designation.

The NVD description explicitly notes that a superuser/auditor gate exists in the application, but it only covers three specific configuration attributes: project_base_dir, project_local_paths, and custom_virtualenvs. The license_info object is excluded from this gate and is therefore returned to every authenticated caller. This is a classic CWE-862 (Missing Authorization) condition—an access control check is either absent or applied to the wrong resource scope.

The license_info payload contains high-value business and infrastructure metadata: account_number, subscription_id, pool_id, sku, support_level, and instance counts. None of these are credentials in the cryptographic sense, but together they constitute an inventory-grade map of a Red Hat subscription estate. Network attack vector (AV:N), low attack complexity (AC:L), low privileges required (PR:L), and no user interaction (UI:N) are all consistent with a simple authenticated HTTP GET against a known API path. Confidentiality impact is rated Low (C:L), reflecting that the data is sensitive but not directly enabling system compromise; integrity and availability impacts are None.

No public proof-of-concept, Nuclei template, or exploit code was available at the time of this report, and no EPSS score has been assigned by FIRST.org. The attack surface is limited to deployments where the /api/v2/config/ endpoint is reachable and where low-privileged authenticated accounts exist.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-862 missing authorization) and the endpoint behavior described in the NVD entry.

1. Reconnaissance and target identification. An attacker with any valid low-privileged account—obtained through credential reuse, a purchased credential, a compromised integration account, or a default/onboarded user—identifies the target application exposing the /api/v2/config/ endpoint. Discovery may occur via standard API enumeration or by referencing publicly known API layout. No special tooling beyond an HTTP client is required.

2. Triggering the flaw. The attacker issues an authenticated request to /api/v2/config/. Because the endpoint applies only IsAuthenticated and the superuser/auditor gate is scoped solely to project_base_dir, project_local_paths, and custom_virtualenvs, the request succeeds and returns the full configuration object, including the license_info block. The attacker does not need to elevate privileges, manipulate parameters, or bypass any cryptographic control—they simply ask for a resource the authorization layer failed to protect.

3. Payload/execution method. No exploit payload is required. The "payload" is a legitimate, well-formed authenticated API request. This makes the activity indistinguishable at the protocol level from normal configuration reads unless logging captures the identity and entitlement of the caller relative to the requested resource.

4. Post-exploitation impact. The attacker harvests account_number, subscription_id, pool_id, sku, support_level, and instance counts. This data supports two confirmed secondary attack paths described in the NVD entry: (a) social engineering against Red Hat support, where accurate subscription and account identifiers lend credibility to an impersonation attempt aimed at entitlement changes, support actions, or information disclosure; and (b) estate sizing reconnaissance, allowing an adversary to understand the scale, support coverage, and product mix of the victim organization to prioritize further targeting. The vulnerability itself does not grant code execution, lateral movement, or persistence.

Impact Assessment

The CVSS v3.1 base score is 4.3 (Medium), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. Exploitation is network-reachable (AV:N), technically trivial (AC:L), requires only a low-privileged authenticated account (PR:L), and needs no victim interaction (UI:N). Scope is unchanged (S:U): the flaw compromises only the vulnerable component's confidentiality. The single impacted security property is confidentiality, rated Low (C:L), because the disclosed data is proprietary business metadata rather than secrets that directly yield system access. Integrity and availability are unaffected.

The blast radius is constrained to organizations running the affected Red Hat product with the /api/v2/config/ endpoint exposed and with multiple authenticated user tiers. Business impact centers on information disclosure that fuels downstream fraud and reconnaissance: leaked account and subscription identifiers materially strengthen pretexting against vendor support channels, while instance counts and SKU/support-level data reveal the size, licensing posture, and operational maturity of the estate. Because the data is persistent and not credential-based, rotation of the exposed identifiers may require vendor coordination, prolonging exposure. The absence of a CISA KEV listing and lack of public exploit code indicate no confirmed in-the-wild exploitation at the time of writing.

Detection Guidance

Sigma Rule

title: Unauthorized Access to Red Hat Config API license_info Endpoint
id: 3f9c1d2e-7a4b-4c8e-9f01-2b6d5e8a1c34
status: experimental
description: Detects authenticated requests to /api/v2/config/ that return license_info to non-privileged users (CVE-2026-71460, CWE-862)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-71460
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/api/v2/config/'
  selection_method:
    cs-method: 'GET'
  filter_privileged:
    cs-username:
      - 'admin'
      - 'superuser'
      - 'auditor'
  condition: selection_endpoint and selection_method and not filter_privileged
falsepositives:
  - Legitimate configuration reads by monitoring integrations using service accounts
level: medium
tags:
  - attack.t1078
  - attack.discovery
  - cve.2026.71460

YARA Rule

rule CVE_2026_71460_Config_License_Disclosure
{
    meta:
        description = "Detects HTTP responses or logs containing license_info disclosure from /api/v2/config/ (CVE-2026-71460)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-71460"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $ep     = "/api/v2/config/" ascii wide nocase
        $lic    = "license_info" ascii wide nocase
        $acct   = "account_number" ascii wide nocase
        $sub    = "subscription_id" ascii wide nocase
        $pool   = "pool_id" ascii wide nocase
        $sku    = "sku" ascii wide nocase
        $supp   = "support_level" ascii wide nocase

    condition:
        $ep and $lic and 2 of ($acct, $sub, $pool, $sku, $supp)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-71460 Red Hat Config API license_info Access Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/v2/config/"; nocase; classtype:attempted-recon; reference:cve,2026-71460; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-71460; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:2026714601; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ authentication where event.outcome == "success" ]
  [ network where url.path like "/api/v2/config/*" and http.request.method == "GET" and
      not user.roles in ("superuser", "auditor") ]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "/api/v2/config/%") AND method="GET"
| eval privileged=if(user IN ("admin","superuser","auditor"), 1, 0)
| where privileged=0
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri_path, status
| where status=200
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="web,access_control,cve_2026_71460,">
  <rule id="202671460" level="10">
    <if_sid>31100</if_sid>
    <url>/api/v2/config/</url>
    <description>CVE-2026-71460: Possible unauthorized access to protected config endpoint /api/v2/config/ returning license_info</description>
    <group>access_control,recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED — a single source, NVD, indicates a patch, not independently confirmed). No specific patched version, commit, or advisory reference is provided in the available data, and no affected version range has been published.

1. Immediate mitigations. Restrict or disable access to /api/v2/config/ at the network and reverse-proxy layer for all but known, essential service accounts. Apply an authorization gate covering license_info equivalent to the existing superuser/auditor control that already protects project_base_dir, project_local_paths, and custom_virtualenvs. Audit and reduce the population of authenticated accounts able to reach the endpoint, and monitor for anomalous GET requests to it. Where possible, block unauthenticated or low-privilege network paths to the API entirely.

2. Patch/upgrade steps. Track the upstream Red Hat advisory for the confirmed fixed build. Because patch confidence is only CLAIMED and the affected version range is unpublished, do not assume a specific version resolves the issue. Verify the fix by testing whether a non-privileged authenticated user receives license_info from /api/v2/config/ after upgrade; if it still does, the version is not fixed and an interim compensating control is required.

3. Long-term hardening. Enforce least-privilege and per-field authorization on configuration and API responses rather than relying on blanket authentication checks. Adopt an API authorization review practice that maps every sensitive response object (e.g., licensing, entitlement, and account data) to an explicit permission requirement. Add regression tests asserting that non-superuser/non-auditor roles cannot retrieve license_info. Centralize detection for sensitive-endpoint access by non-privileged principals and treat entitlement/account data as a protected data class.

References

• NVD — CVE-2026-71460: https://nvd.nist.gov/vuln/detail/CVE-2026-71460
• MITRE CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• FIRST CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• CISA Known Exploited Vulnerabilities Catalog (no entry for CVE-2026-71460 at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Red Hat Product Security (monitor for vendor advisory and fixed build): https://access.redhat.com/security/

No public PoC, exploit code, Nuclei template, or evidence of in-the-wild exploitation or named threat actor campaigns was available at the time of this report.