CVE-2026-71463

Notification template Jinja AST whitelist only inspects
              static Getattr nodes. Dynamic subscripts (job['job'+'_env'])
              and {% if job.id > 100 %} conditional gating bypass both
              the AST check and the test-render (stub has small job.id).
              At runtime, the gated branch executes and exceptions write
              full tracebacks into notification body, which is POSTed
              to attacker-controlled webhook URL. Leaks install paths,
              Python version, source line numbers.