Skip to contentRedhat Ansible Automation Platform vulnerabilities
- axios, red hat cryostat 4, gatekeeper 3 +79 more +81 moreAxios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config MergeCVE-2026-44495Fix available7.0 High
- encode starlette, red hat exploit intelligence, openshift lightspeed +18 more +20 moreStarlette has missing Host header validation that poisons request.url.path, bypassing path-based security checksCVE-2026-48710In KEVPublic exploitFix availableEPSS 70.3%6.5 Medium
- js-cookie javascript cookie, js-cookie, red hat cryostat 4 on rhel 9 +24 more +26 moreJavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injectionCVE-2026-46625Fix available7.5 High
- jqlang jq, red hat ai inference server 3.2, ai inference server 3.3 +38 more +40 morejq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted BuffersCVE-2026-39979Fix available6.9 Medium
- redhat ansible automation platform, red hat ansible automation platform 2, ansible automation platform 2.16 +5 more +7 moreAnsible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissionsCVE-2025-578476.4 Medium
- immutable-js immutable, immutable-js, red hat cluster observability operator 1.5.0 +90 more +92 moreImmutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutableCVE-2026-29063Fix available8.7 High
- redhat ansible automation platform, red hat ansible automation platform 2.5, ansible automation platform 2.5 for rhel 8 +5 more +7 moreAap-gateway: improper path validation in gateway allows credential exfiltrationCVE-2025-99096.7 Medium
- redhat ansible automation platform, red hat ansible automation platform 2.5, ansible automation platform 2.5 for rhel 8 +5 more +7 moreEvent-driven-ansible: sensitive internal headers disclosure in aap eda event streamsCVE-2025-99086.7 Medium
- redhat ansible automation platform, red hat ansible automation platform 2.5, ansible automation platform 2.5 for rhel 8 +5 more +7 moreEvent-driven-ansible: event stream test mode exposes sensitive headers in aap edaCVE-2025-99076.7 Medium
- red hat ansible automation platform 2, redhat ansible automation platform +1 moreAap: sensitive cookie(s) set without security flagsCVE-2025-538613.1 Low
- red hat ansible automation platform 2, redhat ansible automation platform +1 moreAap: aap-gateway: automation-hub: sensitive information disclosureCVE-2025-538623.5 Low
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, redhat ansible automation platform +2 more +4 moreAap-gateway: xss on aap-gatewayCVE-2024-100336.1 Medium
- redhat ansible, fedoraproject fedora, red hat ansible automation platform 2.4 for rhel 8 +7 more +9 moreAnsible-core: possible information leak in tasks that ignore ansible_no_log configurationCVE-2024-0690Fix available5.0 Medium
- redhat ansible automation platform, debian linux, red hat ansible automation platform 1.2 +6 more +8 moreAnsible: malicious role archive can cause ansible-galaxy to overwrite arbitrary filesCVE-2023-5115Fix available6.3 Medium
- couchbase server, cryptography.io cryptography, red hat ansible automation platform 2 +8 more +10 morePython-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659CVE-2023-50782Fix available7.5 High
- redhat ansible, fedoraproject extra packages for enterprise linux, fedora +6 more +8 moreAnsible: template injectionCVE-2023-5764Fix available7.1 High
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, satellite 6.14 for rhel 8 +3 more +5 moreHub: insecure galaxy-importer tarfile extractionCVE-2023-51896.3 Medium
- red hat ansible automation platform 2.3 for rhel 8, ansible automation platform 2.3 for rhel 9, ansible automation platform 2.4 for rhel 8 +5 more +7 moreController: html injection in custom login infoCVE-2023-3971Public exploitFix available7.3 High
- redhat ansible automation platform, red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9 +2 more +4 morePlatform: token exposed at importing projectCVE-2023-43806.3 Medium
- redhat ansible automation platform, red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9 +1 more +3 morePlatform: ec2_key module prints out the private key directly to the standard outputCVE-2023-4237Fix available7.3 High
- eclipse jetty, ietf http, http/2 +166 more +168 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarationsCVE-2023-44487In KEVPublic exploitFix availableEPSS 100.0%7.5 High
- pulpproject pulp ansible, redhat ansible automation platform, satellite +1 more +3 morePlaintext storage of tokens in pulp_ansibleCVE-2022-3644Fix available5.5 Medium
- red hat ansible automation platform 1.2, redhat ansible automation platform, red hat ansible automation platform 2 +2 moreController: cross site scripting in automation controller uiCVE-2022-32054.6 Medium
- fedoraproject fedora, redhat ansible automation platform, openshift container platform +2 moreAn Improper Certificate Validation attack was found in Openshift. A re-encrypt Route with...CVE-2022-16326.5 Medium
- red hat ansible-tower, redhat ansible automation platform, ansible automation platform early access +2 more +4 moreA flaw was found in ansible-tower where the default installation is vulnerable to job isolation...CVE-2021-4112Fix available8.8 High
- red hat ansible automation platformA privilege escalation flaw was found in the Ansible Automation Platform. This flaw allows a...CVE-2022-2568Fix available6.5 Medium
- red hat ansible, redhat ansible galaxy, ansible automation platform +2 moreA flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in...CVE-2021-36815.5 Medium
- red hat ansible, redhat ansible engine, ansible automation platform early access +7 more +9 moreAnsible discloses sensitive information in traceback error messageCVE-2021-3620Fix available5.5 Medium
- red hat ansible, redhat ansible automation platform, ansible engine +1 more +3 moreImproper Input Validation and Command Injection in AnsibleCVE-2021-3583Fix available7.1 High
- red hat ansible, redhat ansible engine, debian linux +2 more +4 moreAnsible Exposes Sensitive InformationCVE-2021-20228Fix available7.5 High