The vulnerability resides in the HostList.list() method of Red Hat Ansible Automation Platform 2. This method catches any generic Exception and returns the string representation of the exception back to the caller. When an authenticated user invokes the host_filter functionality, a triggered exception (Django FieldError or PostgreSQL DataError) causes the application to expose detailed internal data. The resulting output includes the entire Host model relation graph with its internal reverse accessors, as well as raw database error messages, revealing schema structure and potentially sensitive metadata.

This flaw affects Red Hat Ansible Automation Platform 2. No additional sub‑version information is specified, so all deployments of this product version are considered vulnerable until a patch is applied.

The CVSS score of 4.3 indicates a moderate severity impact that primarily allows limited information disclosure to authenticated users. The EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation to date. Attackers require legitimate authentication to use the affected host_filter endpoint; no remote code execution or privilege escalation exists. Overall, the risk is moderate and mitigable by applying the vendor’s update.