Skip to contentRed Hat Ansible Automation Platform Ansible Core 2 vulnerabilities
- red hat migration toolkit for applications 8, migration toolkit for virtualization, openshift service mesh 3 +17 more +19 moreAnsible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -> rceCVE-2026-84503Fix available6.7 Medium
- red hat migration toolkit for applications 8, migration toolkit for virtualization, openshift service mesh 3 +12 more +14 moreAnsible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)CVE-2026-1230376.7 Medium
- red hat migration toolkit for applications 8, migration toolkit for virtualization, openshift service mesh 3 +15 more +17 moreAnsible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code executionCVE-2026-89091Fix available8.8 High
- red hat migration toolkit for applications 8, migration toolkit for virtualization, openshift service mesh 3 +29 more +31 moreAnsible-core: argument injection in ansible-galaxy role install leads to arbitrary code executionCVE-2026-11332Fix available7.8 High
- aio-libs aiohttp, red hat exploit intelligence, lightspeed core +27 more +29 moreAIOHTTP Vulnerable to Deserialization of Untrusted DataCVE-2026-34993Fix available6.4 Medium
- cryptography.io cryptography, red hat lightspeed core, migration toolkit for applications 8 +28 more +30 morecryptography has a buffer overflow if non-contiguous buffers were passed to APIsCVE-2026-39892Fix available6.9 Medium
- redhat ansible automation platform, red hat ansible automation platform 2, ansible automation platform 2.16 +5 more +7 moreAnsible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissionsCVE-2025-578476.4 Medium
- pyca pyopenssl, red hat confidential compute attestation, exploit intelligence +37 more +39 morepyOpenSSL DTLS cookie callback buffer overflowCVE-2026-27459Fix available7.2 High
- psf black, red hat openshift lightspeed, ansible automation platform 2 +6 more +8 moreBlack: Arbitrary file writes from unsanitized user input in cache file nameCVE-2026-32274Fix available8.7 High
- cryptography.io cryptography, red hat openshift lightspeed, advanced cluster management for kubernetes 2 +23 more +25 morecryptography Subgroup Attack Due to Missing Subgroup Validation for SECT CurvesCVE-2026-26007Fix available8.2 High
- pypa wheel, red hat discovery 2 for rhel 10, discovery 2 for rhel 8 +57 more +59 morewheel Allows Arbitrary File Permission Modification via Path TraversalCVE-2026-24049Public exploitFix available7.1 High
- dabeaz ply, red hat fence agents remediation operator, migration toolkit for containers +25 more +27 moreAn undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code...CVE-2025-56005Public exploitFix availableDisputedEPSS 18.8%9.8 Critical
- python urllib3, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift 1.18 +105 more +107 moreurllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)CVE-2026-21441Fix available8.9 High
- aio-libs aiohttp, red hat openshift lightspeed, openshift service mesh 2 +18 more +20 moreAIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bombCVE-2025-69223Fix available7.5 High