Skip to contentRed Hat Ansible Automation Platform 2.6 vulnerabilities
- red hat migration toolkit for applications 8, migration toolkit for containers, migration toolkit for virtualization +12 more +14 moreAnsible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injectionCVE-2026-929828.5 High
- red hat ansible automation platform 2, ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9 +9 more +11 morePulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theftCVE-2026-909598.1 High
- red hat ansible automation platform 2, ansible automation platform 2.6 for rhel 9, ansible automation platform 2.7 +2 moreAap-gateway: aap-gateway: authorization bypass via workload identity token forgeryCVE-2026-944166.8 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage processCVE-2026-847246.6 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracleCVE-2026-847206.5 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trustCVE-2026-847184.3 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templatesCVE-2026-847175.3 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnamesCVE-2026-847166.6 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membershipCVE-2026-847125.3 Medium
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, ansible automation platform 2.5 for rhel 8 +4 more +6 moreAutomation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)CVE-2026-847199.9 Critical
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller: incomplete sanitize_jinja() regex allows jinja template injection into ad-hoc module_args, machine-credential fields, and host names, reaching ansible-cor…CVE-2026-847147.1 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijacking variables (bash_env/ld_preload) allowing code execution in…CVE-2026-847067.6 High
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, ansible automation platform 2.5 for rhel 8 +4 more +6 moreAwx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groupsCVE-2026-758849.1 Critical
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting discloses django secret_key and database credentials to an admin…CVE-2026-846918.7 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink sequences (javascript: anchor) enabling…CVE-2026-846838.7 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplatenode survey min/max validation error me…CVE-2026-844997.7 High
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, ansible automation platform 2.5 for rhel 8 +4 more +6 moreAutomation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane podCVE-2026-845029.9 Critical
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, ansible automation platform 2.5 for rhel 8 +4 more +6 moreAutomation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisionin…CVE-2026-844749.9 Critical
- red hat ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9, ansible automation platform 2.7 +2 moreAutomation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (allowany, routed without debug guard) allow advisory-lock starvation o…CVE-2026-844868.2 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executableCVE-2026-714653.1 Low
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt bypasses leading-dash git-argument guardCVE-2026-714643.1 Low
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via conditional gating leaks tracebacksCVE-2026-714632.7 Low
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control podCVE-2026-714624.1 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license details via /config/CVE-2026-714604.3 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structureCVE-2026-714595.0 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumerationCVE-2026-714585.0 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level instead of use level, allowing execution-placement authorization…CVE-2026-844706.4 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAwx: notification backends allow ssrf and credential leakageCVE-2026-713667.7 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAwx: project archive extraction allows path traversal file writesCVE-2026-713647.2 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAwx: webhook status callback ssrf leaks the git patCVE-2026-713657.7 High
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, ansible automation platform 2.5 for rhel 8 +4 more +6 moreAutomation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrfCVE-2026-125649.6 Critical
- red hat ansible automation platform 2, ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9 +1 more +3 moreAap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http headerCVE-2026-181418.2 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 for rhel 9 +1 more +3 moreEda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dnCVE-2026-123837.5 High
- red hat ansible automation platform 2, ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9 +10 more +12 morePulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexportCVE-2026-127019.0 Critical
- red hat confidential compute attestation, ansible automation platform 2, ansible automation platform 2.6 for rhel 9 +12 more +14 moreSequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusionCVE-2026-42784Fix available7.4 High
- fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +49 more +51 morefast-uri vulnerable to host confusion via failed IDN canonicalizationCVE-2026-13676Fix available7.5 High
- red hat ansible automation platform 2, ansible automation platform 2.5, ansible automation platform 2.5 for rhel 8 +4 more +6 moreEda-server: websocket missing authorization allows credential theft via activation_id spoofingCVE-2026-11807Fix available9.6 Critical
- vllm, red hat exploit intelligence, openshift lightspeed +12 more +14 morevLLM: OpenAI auth bypassCVE-2026-48746Fix available9.1 Critical
- red hat ansible automation platform 2, ansible automation platform 2.6, ansible automation platform 2.7 +2 moreAnsible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expirationCVE-2026-441885.3 Medium
- form-data, red hat cluster observability operator 1.5.0, cryostat 4 +77 more +79 moreform-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)CVE-2026-12143Fix available8.7 High
- red hat ansible automation platform 2, ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9 +3 more +5 moreAwxkit: path traversal via yaml !include directiveCVE-2026-529024.7 Medium
- red hat migration toolkit for applications 8, migration toolkit for virtualization, openshift service mesh 3 +29 more +31 moreAnsible-core: argument injection in ansible-galaxy role install leads to arbitrary code executionCVE-2026-11332Fix available7.8 High
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: Allocation of Resources Without Limits or Throttling in axiosCVE-2026-44488Fix available7.5 High
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP AdapterCVE-2026-44487Fix available8.2 High
- go standard library crypto/x509, red hat assisted installer for red hat openshift container platform 2, cert manager support for red hat openshift release 1.19 +128 more +130 moreInefficient candidate hostname parsing in crypto/x509CVE-2026-27145Public exploitFix available6.5 Medium
- aio-libs aiohttp, red hat exploit intelligence, lightspeed core +27 more +29 moreAIOHTTP Vulnerable to Deserialization of Untrusted DataCVE-2026-34993Fix available6.4 Medium
- axios, red hat cryostat 4, gatekeeper 3 +79 more +81 moreAxios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config MergeCVE-2026-44495Fix available7.0 High
- jpadilla pyjwt, red hat openshift lightspeed, ai inference server +37 more +39 morePyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowedCVE-2026-48526Fix available7.4 High
- pip maintainers pip, red hat exploit intelligence, lightspeed core +34 more +36 morepip can extract console_scripts and gui_scripts outside installation directoryCVE-2026-8643Fix available4.1 Medium
- encode starlette, red hat exploit intelligence, openshift lightspeed +18 more +20 moreStarlette has missing Host header validation that poisons request.url.path, bypassing path-based security checksCVE-2026-48710In KEVPublic exploitFix availableEPSS 70.3%6.5 Medium
- Show moreLoading…