Redhat Ansible vulnerabilities

• axios, red hat cryostat 4, gatekeeper 3 +79 more +81 more Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVE-2026-44495 Fix available 7.0 HighMay 29, 2026
• encode starlette, red hat exploit intelligence, openshift lightspeed +18 more +20 more Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks CVE-2026-48710 In KEVPublic exploitFix available EPSS 70.3% 6.5 MediumMay 22, 2026
• js-cookie javascript cookie, js-cookie, red hat cryostat 4 on rhel 9 +24 more +26 more JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection CVE-2026-46625 Fix available 7.5 HighMay 21, 2026
• jqlang jq, red hat ai inference server 3.2, ai inference server 3.3 +38 more +40 more jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers CVE-2026-39979 Fix available 6.9 MediumApril 13, 2026
• redhat ansible automation platform, red hat ansible automation platform 2, ansible automation platform 2.16 +5 more +7 more Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions CVE-2025-57847 6.4 MediumApril 8, 2026
• immutable-js immutable, immutable-js, red hat cluster observability operator 1.5.0 +90 more +92 more Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable CVE-2026-29063 Fix available 8.7 HighMarch 4, 2026
• redhat ansible automation platform, red hat ansible automation platform 2.5, ansible automation platform 2.5 for rhel 8 +5 more +7 more Aap-gateway: improper path validation in gateway allows credential exfiltration CVE-2025-9909 6.7 MediumNovember 20, 2025
• redhat ansible automation platform, red hat ansible automation platform 2.5, ansible automation platform 2.5 for rhel 8 +5 more +7 more Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams CVE-2025-9908 6.7 MediumOctober 29, 2025
• redhat ansible automation platform, red hat ansible automation platform 2.5, ansible automation platform 2.5 for rhel 8 +5 more +7 more Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda CVE-2025-9907 6.7 MediumOctober 29, 2025
• red hat ansible automation platform 2, redhat ansible automation platform +1 more Aap: sensitive cookie(s) set without security flags CVE-2025-53861 3.1 LowJuly 11, 2025
• red hat ansible automation platform 2, redhat ansible automation platform +1 more Aap: aap-gateway: automation-hub: sensitive information disclosure CVE-2025-53862 3.5 LowJuly 11, 2025
• red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, redhat ansible automation platform +2 more +4 more Aap-gateway: xss on aap-gateway CVE-2024-10033 6.1 MediumOctober 16, 2024
• redhat ansible, fedoraproject fedora, red hat ansible automation platform 2.4 for rhel 8 +7 more +9 more Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration CVE-2024-0690 Fix available 5.0 MediumFebruary 6, 2024
• redhat ansible automation platform, debian linux, red hat ansible automation platform 1.2 +6 more +8 more Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files CVE-2023-5115 Fix available 6.3 MediumDecember 18, 2023
• couchbase server, cryptography.io cryptography, red hat ansible automation platform 2 +8 more +10 more Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659 CVE-2023-50782 Fix available 7.5 HighDecember 14, 2023
• redhat ansible, fedoraproject extra packages for enterprise linux, fedora +6 more +8 more Ansible: template injection CVE-2023-5764 Fix available 7.1 HighDecember 12, 2023
• red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, satellite 6.14 for rhel 8 +3 more +5 more Hub: insecure galaxy-importer tarfile extraction CVE-2023-5189 6.3 MediumNovember 14, 2023
• red hat ansible automation platform 2.3 for rhel 8, ansible automation platform 2.3 for rhel 9, ansible automation platform 2.4 for rhel 8 +5 more +7 more Controller: html injection in custom login info CVE-2023-3971 Public exploitFix available 7.3 HighOctober 4, 2023
• redhat ansible automation platform, red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9 +2 more +4 more Platform: token exposed at importing project CVE-2023-4380 6.3 MediumOctober 4, 2023
• redhat ansible automation platform, red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9 +1 more +3 more Platform: ec2_key module prints out the private key directly to the standard output CVE-2023-4237 Fix available 7.3 HighOctober 4, 2023
• eclipse jetty, ietf http, http/2 +166 more +168 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2023-44487 In KEVPublic exploitFix available EPSS 100.0% 7.5 HighJuly 10, 2023
• redhat ansible, ansible collection +1 more Ansible leaks password to logs CVE-2022-3697 Fix available 7.5 HighOctober 28, 2022
• pulpproject pulp ansible, redhat ansible automation platform, satellite +1 more +3 more Plaintext storage of tokens in pulp_ansible CVE-2022-3644 Fix available 5.5 MediumOctober 25, 2022
• red hat ansible automation platform 1.2, redhat ansible automation platform, red hat ansible automation platform 2 +2 more Controller: cross site scripting in automation controller ui CVE-2022-3205 4.6 MediumSeptember 13, 2022
• fedoraproject fedora, redhat ansible automation platform, openshift container platform +2 more An Improper Certificate Validation attack was found in Openshift. A re-encrypt Route with... CVE-2022-1632 6.5 MediumSeptember 1, 2022
• red hat ansible-tower, redhat ansible automation platform, ansible automation platform early access +2 more +4 more A flaw was found in ansible-tower where the default installation is vulnerable to job isolation... CVE-2021-4112 Fix available 8.8 HighAugust 25, 2022
• redhat ansible runner ansible-runner vulnerable to shell command injection CVE-2021-4041 Fix available 7.8 HighAugust 24, 2022
• redhat ansible runner ansible-runner vulnerable to Race Condition CVE-2021-3702 Fix available 6.3 MediumAugust 23, 2022
• redhat ansible runner ansible-runner has default temporary files written to world R/W locations CVE-2021-3701 Fix available 6.6 MediumAugust 23, 2022
• red hat ansible automation platform A privilege escalation flaw was found in the Ansible Automation Platform. This flaw allows a... CVE-2022-2568 Fix available 6.5 MediumAugust 18, 2022
• red hat ansible, redhat ansible galaxy, ansible automation platform +2 more A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in... CVE-2021-3681 5.5 MediumApril 18, 2022
• red hat ansible, redhat ansible engine, ansible automation platform early access +7 more +9 more Ansible discloses sensitive information in traceback error message CVE-2021-3620 Fix available 5.5 MediumOctober 23, 2021
• red hat ansible, redhat ansible automation platform, ansible engine +1 more +3 more Improper Input Validation and Command Injection in Ansible CVE-2021-3583 Fix available 7.1 HighSeptember 22, 2021
• red hat tower, redhat ansible tower +1 more A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data... CVE-2020-14329 3.3 LowMay 27, 2021
• red hat tower, redhat ansible tower +1 more A flaw was found in Ansible Tower in versions before 3.7.2. A Server Side Request Forgery flaw... CVE-2020-14328 3.3 LowMay 27, 2021
• red hat tower, redhat ansible tower +1 more A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and... CVE-2020-14327 5.5 MediumMay 27, 2021
• red hat tower, redhat ansible tower +1 more A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2... CVE-2020-10709 7.1 HighMay 27, 2021
• red hat tower, redhat ansible tower +1 more A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the... CVE-2020-10698 3.3 LowMay 27, 2021
• red hat tower, redhat ansible tower +1 more A flaw was found in Ansible Tower when running Openshift. Tower runs a memcached, which is... CVE-2020-10697 4.4 MediumMay 27, 2021
• red hat ansible, redhat ansible tower, fedoraproject fedora +2 more A flaw was found in several ansible modules, where parameters containing credentials, such as... CVE-2021-3447 Fix available 5.5 MediumApril 1, 2021
• red hat ansible, redhat ansible engine, debian linux +2 more +4 more Ansible Exposes Sensitive Information CVE-2021-20228 Fix available 7.5 HighMarch 12, 2021
• red hat ansible, oracle virtualization, redhat ansible tower +5 more +7 more Insertion of Sensitive Information into Log File in ansible CVE-2021-20191 Fix available 5.5 MediumMarch 12, 2021
• red hat ansible Insertion of Sensitive Information into Log File in ansible CVE-2021-20180 Fix available 5.5 MediumMarch 12, 2021
• red hat ansible, fedoraproject fedora, redhat ansible tower +2 more Insertion of Sensitive Information into Log File in ansible CVE-2021-20178 Fix available 5.5 MediumMarch 12, 2021
• red hat ansible-tower, redhat ansible tower +1 more A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape... CVE-2021-20253 Public exploit 6.7 MediumMarch 9, 2021
• red hat ansible, redhat ansible engine, debian linux +2 more Insufficiently random values in Ansible CVE-2020-10729 Fix available 5.5 MediumNovember 12, 2020
• redhat ansible, ansible community community collections +1 more Ansible does not collect garbage after playbook run CVE-2020-25635 Fix available 5.0 MediumOctober 5, 2020
• redhat ansible, ansible community community collections +1 more A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers. Files are written directly to the root bucket, making possible to have… CVE-2020-25636 6.6 MediumOctober 5, 2020
• red hat ansible, redhat ansible engine, debian linux +2 more Insertion of Sensitive Information into Log File and Improper Output Neutralization for Logs in ansible CVE-2020-14332 Fix available 5.5 MediumSeptember 11, 2020
• red hat ansible, debian linux, redhat ansible engine +2 more Improper Output Neutralization and Improper Encoding or Escaping of Output for Logs in ansible CVE-2020-14330 Fix available 5.0 MediumSeptember 11, 2020
• Show olderLoading…