Skip to contentRed Hat Ansible Automation Platform 2 vulnerabilities
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 7 +4 more +6 moreJwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verificationCVE-2026-841855.9 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level instead of use level, allowing execution-placement authorization…CVE-2026-844706.4 Medium
- red hat ansible automation platform 2, satellite 6, update infrastructure 4 for cloud providers +1 more +3 morePulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg contentCVE-2026-842325.4 Medium
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 9 +2 more +4 moreJwcrypto: jwcrypto: denial of service via malformed jwe tokensCVE-2026-801795.9 Medium
- red hat ansible automation platform 2Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restrictionCVE-2026-797176.4 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAwx: notification backends allow ssrf and credential leakageCVE-2026-713667.7 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAwx: project archive extraction allows path traversal file writesCVE-2026-713647.2 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAwx: webhook status callback ssrf leaks the git patCVE-2026-713657.7 High
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, ansible automation platform 2.5 for rhel 8 +4 more +6 moreAutomation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrfCVE-2026-125649.6 Critical
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 8 +7 more +9 morePodman: podman: quadlet install --replace non-truncating write retains removed host-access directivesCVE-2026-19730Fix available4.2 Medium
- red hat ansible automation platform 2, ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9 +1 more +3 moreAap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http headerCVE-2026-181418.2 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 for rhel 9 +1 more +3 moreEda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dnCVE-2026-123837.5 High
- red hat ansible automation platform 2Ansible-lightspeed: visual studio code ansible lightspeed extension: remote code execution via command injection in configuration settingsCVE-2026-441917.8 High
- red hat ansible automation platform 2Ansible-lightspeed: ansible lightspeed extension for visual studio code: information disclosure of google gemini api keyCVE-2026-441873.3 Low
- red hat ansible automation platform 2Ansible-lightspeed: ansible lightspeed mcp server: remote code execution and data exfiltration via path traversalCVE-2026-441926.6 Medium
- red hat ansible automation platform 2Ansible-lightspeed: ansible lightspeed visual studio code extension: arbitrary code execution via command injection in activation script settingCVE-2026-441907.8 High
- red hat ansible automation platform 2Ansible-lightspeed: visual studio code ansible lightspeed extension: arbitrary code execution via malicious playbook filenameCVE-2026-441897.8 High
- red hat ansible automation platform 2Awx: websocket eventconsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosureCVE-2026-165446.5 Medium
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 8 +4 more +6 moreAnsible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)CVE-2026-16493Fix available7.8 High
- red hat ansible automation platform 2, ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9 +10 more +12 morePulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexportCVE-2026-127019.0 Critical
- red hat confidential compute attestation, ansible automation platform 2, ansible automation platform 2.6 for rhel 9 +12 more +14 moreSequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusionCVE-2026-42784Fix available7.4 High
- fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +49 more +51 morefast-uri vulnerable to host confusion via failed IDN canonicalizationCVE-2026-13676Fix available7.5 High
- fasterxml jackson-databind, red hat cryostat 4 on rhel 9, openshift developer tools and services +44 more +46 morejackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)CVE-2026-54513Fix available8.1 High
- red hat ansible automation platform 2, ansible automation platform 2.5, ansible automation platform 2.5 for rhel 8 +4 more +6 moreEda-server: websocket missing authorization allows credential theft via activation_id spoofingCVE-2026-11807Fix available9.6 Critical
- berriai litellm, red hat exploit intelligence, ansible automation platform 2 +1 more +3 moreBerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authenticationCVE-2026-12773Fix available6.9 Medium
- red hat ansible automation platform 2Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credentialCVE-2026-127266.3 Medium
- berriai litellm, red hat exploit intelligence, ansible automation platform 2 +1 more +3 moreLiteLLM: Authentication Bypass via Host Header InjectionCVE-2026-49468Public exploitFix available9.5 Critical
- vllm, red hat exploit intelligence, openshift lightspeed +12 more +14 morevLLM: OpenAI auth bypassCVE-2026-48746Fix available9.1 Critical
- red hat ansible automation platform 2Galaxy_ng: shell injection in legacy role import via unsanitized git ref namesCVE-2026-123987.5 High
- nltk, red hat exploit intelligence, openshift lightspeed +4 more +6 moreNLTK: URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File ReadCVE-2026-54293Fix available7.5 High
- encode starlette, red hat exploit intelligence, migration toolkit for applications 8 +8 more +10 moreStarlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on WindowsCVE-2026-48818Fix available7.5 High
- websockets ws, red hat cluster observability operator 1.5.0, cryostat 4 +46 more +48 morews: Memory exhaustion DoS from tiny fragments and data chunksCVE-2026-48779Fix available7.5 High
- red hat ansible automation platform 2, ansible automation platform 2.6, ansible automation platform 2.7 +2 moreAnsible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expirationCVE-2026-441885.3 Medium
- form-data, red hat cluster observability operator 1.5.0, cryostat 4 +77 more +79 moreform-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)CVE-2026-12143Fix available8.7 High
- red hat ansible automation platform 2, ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9 +3 more +5 moreAwxkit: path traversal via yaml !include directiveCVE-2026-529024.7 Medium
- red hat migration toolkit for applications 8, migration toolkit for virtualization, openshift service mesh 3 +29 more +31 moreAnsible-core: argument injection in ansible-galaxy role install leads to arbitrary code executionCVE-2026-11332Fix available7.8 High
- axios, red hat cryostat 4, gatekeeper 3 +62 more +64 moreAxios: Regular Expression Denial of Service (ReDoS) via Cookie Name InjectionCVE-2026-44496Fix available7.5 High
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: Allocation of Resources Without Limits or Throttling in axiosCVE-2026-44488Fix available7.5 High
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP AdapterCVE-2026-44487Fix available8.2 High
- axios, red hat cryostat 4, gatekeeper 3 +63 more +65 moreAxios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connectionCVE-2026-44486Fix available7.5 High
- huggingface huggingface/transformers, transformers, red hat openshift lightspeed +7 more +9 morePolicy Bypass in LightGlue Nested Config Resolution in huggingface/transformersCVE-2026-5241Fix available8.0 High
- go standard library crypto/x509, red hat assisted installer for red hat openshift container platform 2, cert manager support for red hat openshift release 1.19 +128 more +130 moreInefficient candidate hostname parsing in crypto/x509CVE-2026-27145Public exploitFix available6.5 Medium
- aio-libs aiohttp, red hat exploit intelligence, lightspeed core +27 more +29 moreAIOHTTP Vulnerable to Deserialization of Untrusted DataCVE-2026-34993Fix available6.4 Medium
- vitejs launch-editor, vite, red hat cluster observability operator 1.5.0 +25 more +27 morelaunch-editor vulnerable to command injection via the crafted request on WindowsCVE-2024-52011Public exploitFix available7.5 High
- axios, red hat cryostat 4, gatekeeper 3 +79 more +81 moreAxios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config MergeCVE-2026-44495Fix available7.0 High
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`CVE-2026-44494Fix available8.7 High
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)CVE-2026-44492Fix availableEPSS 12.3%8.6 High
- jpadilla pyjwt, red hat openshift lightspeed, ai inference server +37 more +39 morePyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowedCVE-2026-48526Fix available7.4 High
- pip maintainers pip, red hat exploit intelligence, lightspeed core +34 more +36 morepip can extract console_scripts and gui_scripts outside installation directoryCVE-2026-8643Fix available4.1 Medium
- shell-quote, red hat cluster observability operator 1.5.0, cryostat 4 +46 more +48 moreshell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`CVE-2026-9277Public exploitFix available9.2 Critical
- Show moreLoading…