Skip to contentRed Hat Ansible Automation Platform vulnerabilities
- red hat ansible automation platform 2Awx: unauthenticated debug endpoints trigger scheduler operationsCVE-2026-713635.3 Medium
- red hat ansible automation platform 2Awx: websocket broadcast groups leak cross-organization job metadataCVE-2026-713674.3 Medium
- red hat ansible automation platform 2Aap-gateway-operator: resource-server secret exposed in plaintext in the automationcontroller custom resourceCVE-2026-1266436.5 Medium
- red hat ansible automation platform 2Ansible-pylibssh: accepts a changed ssh host key when host_key_auto_add is enabledCVE-2026-1266416.5 Medium
- red hat ansible automation platform 2Awx: webhook credential assignment omits use_role check, exposing another user's tokenCVE-2026-1266426.5 Medium
- red hat ansible automation platform 2, satellite 6, update infrastructure 4 for cloud providers +1 more +3 morePython-pulpcore: pulpcore: header content guard jq filter exposes the content-app environmentCVE-2026-1230846.5 Medium
- red hat ansible automation platform 2Automation-controller: automation-controller: quadratic regex in schedule rrule validation allows an authenticated user to exhaust api web workers (denial of service)CVE-2026-1250634.3 Medium
- red hat migration toolkit for applications 8, migration toolkit for virtualization, openshift service mesh 3 +17 more +19 moreAnsible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -> rceCVE-2026-84503Fix available6.7 Medium
- red hat migration toolkit for applications 8, migration toolkit for virtualization, openshift service mesh 3 +12 more +14 moreAnsible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)CVE-2026-1230376.7 Medium
- red hat confidential compute attestation, dpu kit for nvidia, exploit intelligence +18 more +20 morePodman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layersCVE-2026-1142363.3 Low
- red hat ansible automation platform 2Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)CVE-2026-1091315.4 Medium
- red hat migration toolkit for applications 8, migration toolkit for containers, migration toolkit for virtualization +12 more +14 moreAnsible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injectionCVE-2026-929828.5 High
- red hat migration toolkit for applications 8, migration toolkit for virtualization, openshift service mesh 3 +15 more +17 moreAnsible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code executionCVE-2026-89091Fix available8.8 High
- red hat ansible automation platform 2, satellite 6 +1 morePulp-ansible: bearer tokens are reused across remotes in a workerCVE-2026-1038696.5 Medium
- red hat ansible automation platform 2, satellite 6, update infrastructure 4 for cloud providers +1 more +3 morePulp-container: registry credentials are reused across remotes in a workerCVE-2026-1038686.5 Medium
- red hat ansible automation platform 2, hardened images +1 moreAnsible: ansible-ui: ansible ui dom xss in /redirect next parameterCVE-2026-1060335.4 Medium
- red hat ansible automation platform 2Ansible-runner: ansible-runner: path traversal and symlink escape in unstream_dir() allows file write outside the target directoryCVE-2026-1037545.9 Medium
- red hat ansible automation platform 2, ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9 +9 more +11 morePulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theftCVE-2026-909598.1 High
- red hat ansible automation platform 2, ansible automation platform 2.6 for rhel 9, ansible automation platform 2.7 +2 moreAap-gateway: aap-gateway: authorization bypass via workload identity token forgeryCVE-2026-944166.8 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage processCVE-2026-847246.6 Medium
- red hat ansible automation platform 2, ansible automation platform 2.7 +1 moreAutomation-controller: automation-controller: email notification backend allows ssrf via user-controlled smtp host/port (internal port-scan oracle, smtp password exfil)CVE-2026-847216.4 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracleCVE-2026-847206.5 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trustCVE-2026-847184.3 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templatesCVE-2026-847175.3 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnamesCVE-2026-847166.6 Medium
- red hat ansible automation platform 2, ansible automation platform 2.7 +1 moreAutomation-controller: automation-controller: notification.recipients/subject/error lack prevent_search, allowing zero-privilege cross-tenant recovery of notification recipient secrets via filter orac…CVE-2026-847136.5 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membershipCVE-2026-847125.3 Medium
- red hat ansible automation platform 2, ansible automation platform 2.7 +1 moreAutomation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslog…CVE-2026-854757.2 High
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, ansible automation platform 2.5 for rhel 8 +4 more +6 moreAutomation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)CVE-2026-847199.9 Critical
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller: incomplete sanitize_jinja() regex allows jinja template injection into ad-hoc module_args, machine-credential fields, and host names, reaching ansible-cor…CVE-2026-847147.1 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijacking variables (bash_env/ld_preload) allowing code execution in…CVE-2026-847067.6 High
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, ansible automation platform 2.5 for rhel 8 +4 more +6 moreAwx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groupsCVE-2026-758849.1 Critical
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting discloses django secret_key and database credentials to an admin…CVE-2026-846918.7 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink sequences (javascript: anchor) enabling…CVE-2026-846838.7 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplatenode survey min/max validation error me…CVE-2026-844997.7 High
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, ansible automation platform 2.5 for rhel 8 +4 more +6 moreAutomation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane podCVE-2026-845029.9 Critical
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, ansible automation platform 2.5 for rhel 8 +4 more +6 moreAutomation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisionin…CVE-2026-844749.9 Critical
- red hat ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9, ansible automation platform 2.7 +2 moreAutomation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (allowany, routed without debug guard) allow advisory-lock starvation o…CVE-2026-844868.2 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executableCVE-2026-714653.1 Low
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt bypasses leading-dash git-argument guardCVE-2026-714643.1 Low
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via conditional gating leaks tracebacksCVE-2026-714632.7 Low
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control podCVE-2026-714624.1 Medium
- red hat ansible automation platform 2, ansible automation platform 2.7 +1 moreAutomation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handlerCVE-2026-714614.3 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license details via /config/CVE-2026-714604.3 Medium
- red hat ansible automation platform 2, ansible automation platform 2.7 +1 moreAutomation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job template secret recoveryCVE-2026-766488.5 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structureCVE-2026-714595.0 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumerationCVE-2026-714585.0 Medium
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 7 +5 more +7 moreJwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops arrayCVE-2026-92091Fix available5.9 Medium
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 8 +6 more +8 morePodman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directoryCVE-2026-79699Fix available4.4 Medium
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 8 +7 more +9 morePodman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callersCVE-2026-79705Fix available4.5 Medium
- Show moreLoading…