An unbounded path existence check in the custom_venv_path configuration allows a tenant superuser to probe arbitrary absolute filesystem locations on the controller-web pod. By sending appropriately crafted requests, the service replies with a 200 or 400 status that discloses whether a path exists. This oracle can expose sensitive files such as /etc/tower/SECRET_KEY, Kubernetes service‑account tokens, receptor sockets, and ConfigMap mount points, potentially enabling further compromise of the host environment. The flaw is a logic error in input handling documented under CWE‑204.

Red Hat Ansible Automation Platform 2, specifically the Automation Controller component when the custom_venv_path setting is enabled. Any deployment of AAP 2 that has not yet applied the recent fix is affected.

The CVSS score of 4.1 indicates a moderate severity. EPSS is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog, suggesting a lower likelihood of widespread exploitation. However, the attack requires an authenticated tenant superuser role, which means that only users with elevated privileges can leverage the path‑existence oracle. Once a superuser has confirmed the presence of a secret file, they could potentially read or mount it, leading to broader system compromise. The exploit is straightforward for those with the necessary role, so timely remediation is advisable.