Skip to contentRed Hat Ansible Automation Platform 2.4 vulnerabilities
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, ansible automation platform 2.5 for rhel 8 +4 more +6 moreAutomation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)CVE-2026-847199.9 Critical
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, ansible automation platform 2.5 for rhel 8 +4 more +6 moreAwx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groupsCVE-2026-758849.1 Critical
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, ansible automation platform 2.5 for rhel 8 +4 more +6 moreAutomation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane podCVE-2026-845029.9 Critical
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, ansible automation platform 2.5 for rhel 8 +4 more +6 moreAutomation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisionin…CVE-2026-844749.9 Critical
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, ansible automation platform 2.5 for rhel 8 +4 more +6 moreAutomation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrfCVE-2026-125649.6 Critical
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +160 more +162 moreMemory exhaustion in query parameter parsing in net/urlCVE-2025-61726Fix available7.5 High
- python urllib3, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift 1.18 +105 more +107 moreurllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)CVE-2026-21441Fix available8.9 High
- aio-libs aiohttp, red hat openshift lightspeed, openshift service mesh 2 +18 more +20 moreAIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bombCVE-2025-69223Fix available7.5 High
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, ansible automation platform 2.5 for rhel 8 +1 more +3 moreEvent-driven-ansible: exposure inventory passwords in plain text when starting a rulebook activation with verbosity set to debug in edaCVE-2025-2877Fix available6.5 Medium
- red hat ansible automation platform execution environments, ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9 +4 more +6 moreAnsible-core: ansible-core user may read/write unauthorized contentCVE-2024-9902Public exploitFix available6.3 Medium
- red hat ansible automation platform execution environments, discovery 1 for rhel 9, ansible automation platform 2.4 for rhel 8 +7 more +9 moreAnsible-core: exposure of sensitive information in ansible vault files due to improper loggingCVE-2024-8775Fix available5.5 Medium
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9 +1 moreAutomation-controller: gain access to the k8s api server via job execution with container groupCVE-2024-68406.6 Medium
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9 +1 morePlatform: insecure websocket used when interacting with eda serverCVE-2024-16578.1 High
- red hat nbde tang server, openshift developer tools and services, openshift pipelines +32 more +34 moreGolang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloadsCVE-2024-1394Fix available7.5 High
- redhat ansible, fedoraproject fedora, red hat ansible automation platform 2.4 for rhel 8 +7 more +9 moreAnsible-core: possible information leak in tasks that ignore ansible_no_log configurationCVE-2024-0690Fix available5.0 Medium
- redhat ansible automation platform, debian linux, red hat ansible automation platform 1.2 +6 more +8 moreAnsible: malicious role archive can cause ansible-galaxy to overwrite arbitrary filesCVE-2023-5115Fix available6.3 Medium
- redhat ansible, fedoraproject extra packages for enterprise linux, fedora +6 more +8 moreAnsible: template injectionCVE-2023-5764Fix available7.1 High
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, satellite 6.14 for rhel 8 +3 more +5 moreHub: insecure galaxy-importer tarfile extractionCVE-2023-51896.3 Medium
- red hat ansible automation platform 2.3 for rhel 8, ansible automation platform 2.3 for rhel 9, ansible automation platform 2.4 for rhel 8 +5 more +7 moreController: html injection in custom login infoCVE-2023-3971Public exploitFix available7.3 High
- redhat ansible automation platform, red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9 +2 more +4 morePlatform: token exposed at importing projectCVE-2023-43806.3 Medium
- redhat ansible automation platform, red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9 +1 more +3 morePlatform: ec2_key module prints out the private key directly to the standard outputCVE-2023-4237Fix available7.3 High