CVE-2026-84643

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

9.9 CriticalFix available

CVE-2026-84643 is a critical vulnerability (CVSS 9.9) in automation-controller-venv-tower, published September 24, 2026. No source lists public exploit code. Fixed in automation-controller-venv-tower 0:4.7.17-1.el9ap.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

What each source reports

OSV Score usedRHSA-2026:71113 9.9

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Record: RHSA-2026:71113
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSV Score usedRHSA-2026:71114 9.9

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Record: RHSA-2026:71114
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`automation-controller-venv-tower` Red Hat:ansible_automation_platform:2.6::el9	before 0:4.7.17-1.el9ap	0:4.7.17-1.el9ap
`receptor` Red Hat:ansible_automation_platform:2.6::el10	before 0:1.6.8-1.el10ap	0:1.6.8-1.el10ap
`receptor` Red Hat:ansible_automation_platform_developer:2.6::el9	before 0:1.6.8-1.el9ap	0:1.6.8-1.el9ap
`receptor` Red Hat:ansible_automation_platform_inside:2.6::el9	before 0:1.6.8-1.el9ap	0:1.6.8-1.el9ap
`automation-gateway-proxy-server` Red Hat:ansible_automation_platform:2.6::el9	before 0:2.6.17-3.el9ap	0:2.6.17-3.el9ap
`receptor` Red Hat:ansible_automation_platform:2.6::el9	before 0:1.6.8-1.el9ap	0:1.6.8-1.el9ap
`python-sqlparse` Red Hat:ansible_automation_platform_developer:2.6::el10	before 0:0.6.0-1.el10ap	0:0.6.0-1.el10ap
`python3-sqlparse` Red Hat:ansible_automation_platform_developer:2.6::el10	before 0:0.6.0-1.el10ap	0:0.6.0-1.el10ap
`python-sqlparse` Red Hat:ansible_automation_platform:2.6::el10	before 0:0.6.0-1.el10ap	0:0.6.0-1.el10ap
`python3-sqlparse` Red Hat:ansible_automation_platform:2.6::el10	before 0:0.6.0-1.el10ap	0:0.6.0-1.el10ap

Show 28 moreShow less

Affected packages
Package	Affected	Fixed
`python3.12-sqlparse` Red Hat:ansible_automation_platform_developer:2.6::el9	before 0:0.6.0-1.el9ap	0:0.6.0-1.el9ap
`python3.12-sqlparse` Red Hat:ansible_automation_platform:2.6::el9	before 0:0.6.0-1.el9ap	0:0.6.0-1.el9ap
`automation-platform-ui` Red Hat:ansible_automation_platform:2.6::el9	before 0:2.6.14-1.el9ap	0:2.6.14-1.el9ap
`automation-controller` Red Hat:ansible_automation_platform_developer:2.6::el9	before 0:4.7.17-1.el9ap	0:4.7.17-1.el9ap
`automation-controller-cli` Red Hat:ansible_automation_platform_developer:2.6::el9	before 0:4.7.17-1.el9ap	0:4.7.17-1.el9ap
`automation-controller` Red Hat:ansible_automation_platform:2.6::el9	before 0:4.7.17-1.el9ap	0:4.7.17-1.el9ap
`automation-controller-cli` Red Hat:ansible_automation_platform:2.6::el9	before 0:4.7.17-1.el9ap	0:4.7.17-1.el9ap
`automation-controller-server` Red Hat:ansible_automation_platform:2.6::el9	before 0:4.7.17-1.el9ap	0:4.7.17-1.el9ap
`automation-controller-ui` Red Hat:ansible_automation_platform:2.6::el9	before 0:4.7.17-1.el9ap	0:4.7.17-1.el9ap
`python3.12-gitpython` Red Hat:ansible_automation_platform:2.6::el9	before 0:3.1.60-1.el9ap	0:3.1.60-1.el9ap
`automation-controller-venv-tower` Red Hat:ansible_automation_platform:2.5::el8	before 0:4.6.33-1.el8ap	0:4.6.33-1.el8ap
`automation-controller-venv-tower` Red Hat:ansible_automation_platform:2.5::el9	before 0:4.6.33-1.el9ap	0:4.6.33-1.el9ap
`receptor` Red Hat:ansible_automation_platform_developer:2.5::el8	before 0:1.6.8-1.el8ap	0:1.6.8-1.el8ap
`receptor` Red Hat:ansible_automation_platform_inside:2.5::el8	before 0:1.6.8-1.el8ap	0:1.6.8-1.el8ap
`automation-gateway-proxy-server` Red Hat:ansible_automation_platform:2.5::el8	before 0:2.5.10-8.el8ap	0:2.5.10-8.el8ap
`receptor` Red Hat:ansible_automation_platform:2.5::el8	before 0:1.6.8-1.el8ap	0:1.6.8-1.el8ap
`receptor` Red Hat:ansible_automation_platform_developer:2.5::el9	before 0:1.6.8-1.el9ap	0:1.6.8-1.el9ap
`receptor` Red Hat:ansible_automation_platform_inside:2.5::el9	before 0:1.6.8-1.el9ap	0:1.6.8-1.el9ap
`automation-gateway-proxy-server` Red Hat:ansible_automation_platform:2.5::el9	before 0:2.6.17-3.el9ap	0:2.6.17-3.el9ap
`receptor` Red Hat:ansible_automation_platform:2.5::el9	before 0:1.6.8-1.el9ap	0:1.6.8-1.el9ap
`python3.12-sqlparse` Red Hat:ansible_automation_platform_developer:2.5::el8	before 0:0.6.0-1.el8ap	0:0.6.0-1.el8ap
`python3.12-sqlparse` Red Hat:ansible_automation_platform:2.5::el8	before 0:0.6.0-1.el8ap	0:0.6.0-1.el8ap
`python3.12-sqlparse` Red Hat:ansible_automation_platform_developer:2.5::el9	before 0:0.6.0-1.el9ap	0:0.6.0-1.el9ap
`python3.12-sqlparse` Red Hat:ansible_automation_platform:2.5::el9	before 0:0.6.0-1.el9ap	0:0.6.0-1.el9ap
`automation-gateway-server` Red Hat:ansible_automation_platform:2.5::el8	before 0:2.5.20260923-1.el8ap	0:2.5.20260923-1.el8ap
`automation-gateway-server` Red Hat:ansible_automation_platform:2.5::el9	before 0:2.5.20260923-1.el9ap	0:2.5.20260923-1.el9ap
`python3.12-gitpython` Red Hat:ansible_automation_platform:2.5::el8	before 0:3.1.60-1.el8ap	0:3.1.60-1.el8ap
`python3.12-gitpython` Red Hat:ansible_automation_platform:2.5::el9	before 0:3.1.60-1.el9ap	0:3.1.60-1.el9ap

History

History
When	Changed	Sources
2026-11-02	created	OSV

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 133 references. The JSON record has them.