CVE-2026-52902
Awxkit: path traversal via yaml !include directive
4.7 Medium
A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.format yaml import". This is a client-side vulnerability requiring user interaction.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
0.13%Up 0.1 points since Jun 9, 2026
What each source reports
CVE List Score used
Awxkit: path traversal via yaml !include directive
A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.format yaml import". This is a client-side vulnerability requiring user interaction.
- Record
CVE-2026-52902- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-05
EUVDEUVD-2026-35389
A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.format yaml import". This is a client-side vulnerability requiring user interaction.
- Record
EUVD-2026-35389- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-g29c-rgq6-gxgj
awxkit has a path traversal vulnerability
A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.format yaml import". This is a client-side vulnerability requiring user interaction.
- Record
GHSA-g29c-rgq6-gxgj- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.format yaml import". This is a client-side vulnerability requiring user interaction.
- Record
CVE-2026-52902- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-05
OSVGHSA-g29c-rgq6-gxgj
awxkit has a path traversal vulnerability
A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.format yaml import". This is a client-side vulnerability requiring user interaction.
- Record
GHSA-g29c-rgq6-gxgj- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVPYSEC-2026-3550
awxkit has a path traversal vulnerability
A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.format yaml import". This is a client-side vulnerability requiring user interaction.
- Record
PYSEC-2026-3550- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2026:59135
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Record
RHSA-2026:59135- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:59136
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Record
RHSA-2026:59136- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:59137
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Product Security and Bug Fix Update
- Record
RHSA-2026:59137- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
awxkitPyPI |
through 24.6.1 | None known |
awxkitPyPI |
through 24.6.1, plus listed versions 13.0.014.0.014.1.015.0.015.0.1 Show 45 moreShow less16.0.017.0.017.0.117.1.018.0.019.0.019.1.019.2.019.2.119.2.219.3.019.4.020.0.120.1.021.0.021.1.021.10.021.10.121.10.221.11.021.12.021.13.021.14.021.2.021.3.021.4.021.5.021.6.021.7.021.8.021.9.022.0.022.1.022.2.022.3.022.4.022.5.022.6.022.7.023.0.023.1.023.2.023.3.023.3.123.4.0 |
None known |
python3.12-djangoRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 18 CVEs |
before 0:5.2.17-1.el8ap | 0:5.2.17-1.el8ap |
python3.12-djangoRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 18 CVEs |
before 0:5.2.17-1.el8ap | 0:5.2.17-1.el8ap |
python3.12-djangoRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 18 CVEs |
before 0:5.2.17-1.el9ap | 0:5.2.17-1.el9ap |
python3.12-djangoRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 18 CVEs |
before 0:5.2.17-1.el9ap | 0:5.2.17-1.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 18 CVEs |
before 0:4.6.32-1.el8ap | 0:4.6.32-1.el8ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 18 CVEs |
before 0:4.6.32-1.el9ap | 0:4.6.32-1.el9ap |
automation-gateway-serverRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 18 CVEs |
before 0:2.5.20260824-1.el8ap | 0:2.5.20260824-1.el8ap |
automation-gateway-serverRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 18 CVEs |
before 0:2.5.20260824-1.el9ap | 0:2.5.20260824-1.el9ap |
Show 30 moreShow less
| Package | Affected | Fixed |
|---|---|---|
automation-controller-cliRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 18 CVEs |
before 0:4.6.32-1.el8ap | 0:4.6.32-1.el8ap |
automation-controller-cliRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 18 CVEs |
before 0:4.6.32-1.el8ap | 0:4.6.32-1.el8ap |
automation-controller-cliRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 18 CVEs |
before 0:4.6.32-1.el9ap | 0:4.6.32-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 18 CVEs |
before 0:4.6.32-1.el9ap | 0:4.6.32-1.el9ap |
python3.12-gitpythonRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 18 CVEs |
before 0:3.1.59-1.el8ap | 0:3.1.59-1.el8ap |
python3.12-gitpythonRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 18 CVEs |
before 0:3.1.59-1.el9ap | 0:3.1.59-1.el9ap |
python3.12-aiohttpRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 18 CVEs |
before 0:3.14.3-1.el8ap | 0:3.14.3-1.el8ap |
python3.12-aiohttpRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 18 CVEs |
before 0:3.14.3-1.el9ap | 0:3.14.3-1.el9ap |
automation-platform-uiRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 20 CVEs |
before 0:2.6.13-1.el9ap | 0:2.6.13-1.el9ap |
python-djangoRed Hat:ansible_automation_platform_developer:2.6::el10 From an advisory covering 20 CVEs |
before 0:5.2.17-1.el10ap | 0:5.2.17-1.el10ap |
python3-djangoRed Hat:ansible_automation_platform_developer:2.6::el10 From an advisory covering 20 CVEs |
before 0:5.2.17-1.el10ap | 0:5.2.17-1.el10ap |
python-djangoRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 20 CVEs |
before 0:5.2.17-1.el10ap | 0:5.2.17-1.el10ap |
python3-djangoRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 20 CVEs |
before 0:5.2.17-1.el10ap | 0:5.2.17-1.el10ap |
python3.12-djangoRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 20 CVEs |
before 0:5.2.17-1.el9ap | 0:5.2.17-1.el9ap |
python3.12-djangoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 20 CVEs |
before 0:5.2.17-1.el9ap | 0:5.2.17-1.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 20 CVEs |
before 0:4.7.16-1.el9ap | 0:4.7.16-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 20 CVEs |
before 0:4.7.16-1.el9ap | 0:4.7.16-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 20 CVEs |
before 0:4.7.16-1.el9ap | 0:4.7.16-1.el9ap |
python3.12-gitpythonRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 20 CVEs |
before 0:3.1.59-1.el9ap | 0:3.1.59-1.el9ap |
python3.12-aiohttpRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 20 CVEs |
before 0:3.14.3-1.el9ap | 0:3.14.3-1.el9ap |
python3.12-aiohttp-debuginfoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 20 CVEs |
before 0:3.14.3-1.el9ap | 0:3.14.3-1.el9ap |
python3.12-aiohttp-debugsourceRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 20 CVEs |
before 0:3.14.3-1.el9ap | 0:3.14.3-1.el9ap |
python-djangoRed Hat:ansible_automation_platform_developer:2.7::el10 From an advisory covering 2 CVEs |
before 0:5.2.17-1.el10ap | 0:5.2.17-1.el10ap |
python3-djangoRed Hat:ansible_automation_platform_developer:2.7::el10 From an advisory covering 2 CVEs |
before 0:5.2.17-1.el10ap | 0:5.2.17-1.el10ap |
python-djangoRed Hat:ansible_automation_platform:2.7::el10 From an advisory covering 2 CVEs |
before 0:5.2.17-1.el10ap | 0:5.2.17-1.el10ap |
python3-djangoRed Hat:ansible_automation_platform:2.7::el10 From an advisory covering 2 CVEs |
before 0:5.2.17-1.el10ap | 0:5.2.17-1.el10ap |
python3.12-djangoRed Hat:ansible_automation_platform_developer:2.7::el9 From an advisory covering 2 CVEs |
before 0:5.2.17-1.el9ap | 0:5.2.17-1.el9ap |
python3.12-djangoRed Hat:ansible_automation_platform:2.7::el9 From an advisory covering 2 CVEs |
before 0:5.2.17-1.el9ap | 0:5.2.17-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform:2.7::el10 From an advisory covering 2 CVEs |
before 0:4.8.6-1.el10ap | 0:4.8.6-1.el10ap |
automation-controller-cliRed Hat:ansible_automation_platform:2.7::el9 From an advisory covering 2 CVEs |
before 0:4.8.6-1.el9ap | 0:4.8.6-1.el9ap |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | CVE List, NVD | |
| facts | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-52902 is a medium vulnerability (CVSS 4.7) in Red Hat Ansible Automation Platform 2, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. No source names a fixed version.
References
access.redhat.com/errata/RHSA-2026:59135
bugzilla.redhat.com/show_bug.cgi?id=2486729
nvd.nist.gov/vuln/detail/CVE-2026-52902
Show 134 moreShow less
github.com/advisories/GHSA-g29c-rgq6-gxgj
pypi.org/project/awxkit
docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59135.json
cve.org/CVERecord?id=CVE-2026-15307
docs.djangoproject.com/en/dev/releases/security
groups.google.com/g/django-announce
djangoproject.com/weblog/2026/aug/04/security-releases
vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-clone-from
cwe.mitre.org/data/definitions/93.html
html.spec.whatwg.org/multipage/form-control-infrastructure.html
npmjs.com/package/form-data
This page doesn't list everything
Left out here: 15 versions. The JSON record has them.