Skip to contentRed Hat Ansible Automation Platform 2 vulnerabilities
- red hat migration toolkit for virtualization, openshift pipelines, ansible automation platform 2 +8 more +10 morejsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path ExpressionsCVE-2026-1615Fix available9.2 Critical
- red hat ansible automation platform 2, ansible automation platform 2.6 +1 moreAnsible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed apiCVE-2026-05984.2 Medium
- lfprojects mcp typescript sdk, modelcontextprotocol typescript-sdk, red hat ansible automation platform 2.6 +2 more@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuseCVE-2026-25536Fix available7.1 High
- djangoproject django, red hat ansible automation platform 2, ansible automation platform 2.5 +15 more +17 morePotential SQL injection via QuerySet.order_by and FilteredRelationCVE-2026-1312Public exploitFix available5.4 Medium
- djangoproject django, red hat ansible automation platform 2, ansible automation platform 2.5 +15 more +17 morePotential SQL injection in column aliases via control charactersCVE-2026-1287Fix available5.4 Medium
- djangoproject django, red hat ansible automation platform 2, ansible automation platform 2.5 +15 more +17 morePotential SQL injection via raster lookups on PostGISCVE-2026-1207Public exploitFix availableEPSS 12.8%5.4 Medium
- dchester jsonpath, red hat migration toolkit for virtualization, openshift pipelines +11 more +13 moreJSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.jsCVE-2025-61140Fix available9.8 Critical
- fastapiexpert python-multipart, red hat lightspeed core, openshift lightspeed +11 more +13 morePython-Multipart has Arbitrary File Write via Non-Default ConfigurationCVE-2026-24486Public exploitFix available8.6 High
- google protobuf, red hat ai inference server 3.2, ai inference server 3.3 +14 more +16 moreDenial of Service in Python ProtobufCVE-2026-0994Public exploitFix available8.2 High
- cli, red hat confidential compute attestation, cryostat 4 +32 more +34 morenpm cli Incorrect Permission Assignment Local Privilege Escalation VulnerabilityCVE-2026-0775Fix available7.0 High
- pypa wheel, red hat discovery 2 for rhel 10, discovery 2 for rhel 8 +57 more +59 morewheel Allows Arbitrary File Permission Modification via Path TraversalCVE-2026-24049Public exploitFix available7.1 High
- lodash, lodash lodash-amd, lodash-es +119 more +121 morePrototype Pollution Vulnerability in Lodash _.unset and _.omit functionsCVE-2025-13465Public exploitFix available6.9 Medium
- isaacs node-tar, tar, red hat confidential compute attestation +37 more +39 morenode-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFSCVE-2026-23950Fix available8.8 High
- kozea weasyprint, red hat ansible automation platform 2 +1 moreWeasyPrint Vulnerable to Server-Side Request Forgery (SSRF) Protection Bypass via HTTP RedirectCVE-2025-68616Public exploitFix available7.5 High
- pyasn1, debian linux, red hat lightspeed core +48 more +50 morepyasn1 has a DoS vulnerability in decoderCVE-2026-23490Fix available7.5 High
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +160 more +162 moreMemory exhaustion in query parameter parsing in net/urlCVE-2025-61726Fix available7.5 High
- ollama, red hat ansible automation platform 2, openshift ai (rhoai) +2 moreOllama Multi-Modal Model Image Processing NULL Pointer DereferenceCVE-2025-155148.7 High
- @tanstack react-router, remix-run @remix-run/router, red hat cryostat 4 +74 more +76 moreReact Router vulnerable to XSS via Open RedirectsCVE-2026-22029Fix available8.0 High
- @tanstack react-router, red hat ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9 +6 more +8 moreReact Router SSR XSS in ScrollRestorationCVE-2026-21884Fix available8.2 High
- @tanstack react-router, red hat cryostat 4, gatekeeper 3 +47 more +49 moreReact Router has Path Traversal in File Session StorageCVE-2025-61686Public exploitFix availableEPSS 17.3%9.1 Critical
- @tanstack react-router, red hat ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9 +6 more +8 moreReact Router has XSS VulnerabilityCVE-2025-59057Public exploitFix available7.6 High
- red hat ansible automation platform 2.5, ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9 +2 more +4 moreAnsible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictionsCVE-2025-14025Fix available8.5 High
- python urllib3, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift 1.18 +105 more +107 moreurllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)CVE-2026-21441Fix available8.9 High
- aio-libs aiohttp, red hat openshift lightspeed, openshift service mesh 2 +18 more +20 moreAIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bombCVE-2025-69223Fix available7.5 High
- redhat ansible automation platform, red hat ansible automation platform 2.5, ansible automation platform 2.5 for rhel 8 +5 more +7 moreAap-gateway: improper path validation in gateway allows credential exfiltrationCVE-2025-99096.7 Medium
- redhat ansible automation platform, red hat ansible automation platform 2.5, ansible automation platform 2.5 for rhel 8 +5 more +7 moreEvent-driven-ansible: sensitive internal headers disclosure in aap eda event streamsCVE-2025-99086.7 Medium
- redhat ansible automation platform, red hat ansible automation platform 2.5, ansible automation platform 2.5 for rhel 8 +5 more +7 moreEvent-driven-ansible: event stream test mode exposes sensitive headers in aap edaCVE-2025-99076.7 Medium
- red hat multicluster global hub, openshift serverless, advanced cluster management for kubernetes 2 +1 more +3 moreNx: nx/devkit: malicious versions of nx and plugins published to npmCVE-2025-10894Public exploit9.6 Critical
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9 +1 moreAap-gateway: csrf origin checking is disabledCVE-2025-59885.3 Medium
- ansible django-ansible-base, red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9 +2 morePython3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aapCVE-2025-77384.4 Medium
- red hat ansible automation platform 2, redhat ansible automation platform +1 moreAap: sensitive cookie(s) set without security flagsCVE-2025-538613.1 Low
- red hat ansible automation platform 2, redhat ansible automation platform +1 moreAap: aap-gateway: automation-hub: sensitive information disclosureCVE-2025-538623.5 Low
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9 +1 moreEvent-driven-ansible: authenticated argument injection in git url in eda project creationCVE-2025-495208.8 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9 +1 moreEvent-driven-ansible: template injection via git branch and refspec in eda projectsCVE-2025-495218.8 High
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, ansible automation platform 2.5 for rhel 8 +1 more +3 moreEvent-driven-ansible: exposure inventory passwords in plain text when starting a rulebook activation with verbosity set to debug in edaCVE-2025-2877Fix available6.5 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9 +1 moreAap-gateway: aap-gateway privilege escalationCVE-2025-1801Fix available8.1 High
- red hat .net 6.0 on red hat enterprise linux, cryostat 3, logging subsystem for red hat openshift +52 more +54 moreNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptCVE-2024-11831Fix available5.4 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9 +1 moreAutomation-gateway: aap-gateway: improper scope handling in oauth2 tokens for aap 2.5CVE-2024-114835.0 Medium
- red hat ansible automation platform execution environments, ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9 +2 more +4 moreAnsible-core: unsafe tagging bypass via hostvars object in ansible-coreCVE-2024-11079Fix available5.5 Medium
- red hat ansible automation platform execution environments, ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9 +4 more +6 moreAnsible-core: ansible-core user may read/write unauthorized contentCVE-2024-9902Public exploitFix available6.3 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, redhat ansible automation platform +2 more +4 moreAap-gateway: xss on aap-gatewayCVE-2024-100336.1 Medium
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 8 +1 more +3 morePyo3: risk of use-after-free in `borrowed` reads from python weak referencesCVE-2024-9979Fix available5.3 Medium
- red hat ansible automation platform 2Event-driven automation in ansible automation platform (aap): ansible event-driven automation (eda) lacks encryptionCVE-2024-96205.3 Medium
- red hat nbde tang server, openshift developer tools and services, openshift pipelines +34 more +36 moreGolang-fips: golang fips zeroed bufferCVE-2024-9355Fix available6.5 Medium
- red hat ansible automation platform execution environments, discovery 1 for rhel 9, ansible automation platform 2.4 for rhel 8 +7 more +9 moreAnsible-core: exposure of sensitive information in ansible vault files due to improper loggingCVE-2024-8775Fix available5.5 Medium
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9 +1 moreAutomation-controller: gain access to the k8s api server via job execution with container groupCVE-2024-68406.6 Medium
- pulpproject pulp, red hat ansible automation platform 2, satellite 6 +1 more +3 morePulpcore: rbac permissions incorrectly assigned in tasks that create objectsCVE-2024-71436.7 Medium
- red hat multicluster engine for kubernetes, oadp-1.3-rhel-9, openshift developer tools and services +28 more +30 moreContainers/image: digest type does not guarantee valid typeCVE-2024-3727Fix available8.3 High
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9 +1 morePlatform: insecure websocket used when interacting with eda serverCVE-2024-16578.1 High
- red hat nbde tang server, openshift developer tools and services, openshift pipelines +32 more +34 moreGolang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloadsCVE-2024-1394Fix available7.5 High
- Show moreLoading…