CVE-2026-84678

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

9.9 Critical

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

What each source reports

OSV Score usedRHSA-2026:71114 9.9

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Record: RHSA-2026:71114
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`automation-controller-venv-tower` Red Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs	before 0:4.6.33-1.el8ap	0:4.6.33-1.el8ap
`automation-controller-venv-tower` Red Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs	before 0:4.6.33-1.el9ap	0:4.6.33-1.el9ap
`receptor` Red Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 57 CVEs	before 0:1.6.8-1.el8ap	0:1.6.8-1.el8ap
`receptor` Red Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 57 CVEs	before 0:1.6.8-1.el8ap	0:1.6.8-1.el8ap
`automation-gateway-proxy-server` Red Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs	before 0:2.5.10-8.el8ap	0:2.5.10-8.el8ap
`receptor` Red Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs	before 0:1.6.8-1.el8ap	0:1.6.8-1.el8ap
`receptor` Red Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 57 CVEs	before 0:1.6.8-1.el9ap	0:1.6.8-1.el9ap
`receptor` Red Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 57 CVEs	before 0:1.6.8-1.el9ap	0:1.6.8-1.el9ap
`automation-gateway-proxy-server` Red Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs	before 0:2.6.17-3.el9ap	0:2.6.17-3.el9ap
`receptor` Red Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs	before 0:1.6.8-1.el9ap	0:1.6.8-1.el9ap

Show 8 moreShow less

Affected packages
Package	Affected	Fixed
`python3.12-sqlparse` Red Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 57 CVEs	before 0:0.6.0-1.el8ap	0:0.6.0-1.el8ap
`python3.12-sqlparse` Red Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs	before 0:0.6.0-1.el8ap	0:0.6.0-1.el8ap
`python3.12-sqlparse` Red Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 57 CVEs	before 0:0.6.0-1.el9ap	0:0.6.0-1.el9ap
`python3.12-sqlparse` Red Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs	before 0:0.6.0-1.el9ap	0:0.6.0-1.el9ap
`automation-gateway-server` Red Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs	before 0:2.5.20260923-1.el8ap	0:2.5.20260923-1.el8ap
`automation-gateway-server` Red Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs	before 0:2.5.20260923-1.el9ap	0:2.5.20260923-1.el9ap
`python3.12-gitpython` Red Hat:ansible_automation_platform:2.5::el8 From an advisory covering 57 CVEs	before 0:3.1.60-1.el8ap	0:3.1.60-1.el8ap
`python3.12-gitpython` Red Hat:ansible_automation_platform:2.5::el9 From an advisory covering 57 CVEs	before 0:3.1.60-1.el9ap	0:3.1.60-1.el9ap

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-84678 is a critical vulnerability (CVSS 9.9) in automation-controller-venv-tower, published September 24, 2026. No source lists public exploit code. No source names a fixed version.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 85 references. The JSON record has them.