CVE-2026-71461 [MEDIUM] – HostList.list() catches bare Exception and returns str(e) verbatim. Via host

HostList.list() catches bare Exception and returns str(e)
verbatim. Via host_filter, any authenticated user triggers
Django FieldError (leaking complete Host model relation
graph including internal reverse accessors) or PostgreSQL
DataError (leaking raw database error strings). Two
primitives: credential__search=x dumps ORM schema,
name__regex=[bad reflects PostgreSQL errors.