Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8
18 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-84719 | fixed in 0:4.5.36-1.el8ap | Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instanc… | CRITICAL 9.9 | 0.5 % | ||
| CVE-2026-75884 | fixed in 0:4.5.36-1.el8ap | Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups | CRITICAL 9.1 | 0.4 % | ||
| CVE-2026-84502 | fixed in 0:4.5.36-1.el8ap | Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --u… | CRITICAL 9.9 | 0.6 % | ||
| CVE-2026-84474 | fixed in 0:4.5.36-1.el8ap | Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_… | CRITICAL 9.9 | 0.8 % | ||
| CVE-2026-12564 | fixed in 0:4.5.36-1.el8ap | Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf | CRITICAL 9.6 | 0.3 % | ||
| CVE-2025-2877 | fixed in 0:1.0.8-2.el8ap | Event-driven-ansible: exposure inventory passwords in plain text when starting a rulebook activation with verbosity set to debug in eda | MEDIUM 6.5 | 0.4 % | ||
| CVE-2024-9902 | | Ansible-core: ansible-core user may read/write unauthorized content | MEDIUM 6.3 | 0.3 % | ||
| CVE-2024-8775 | | Ansible-core: exposure of sensitive information in ansible vault files due to improper logging | MEDIUM 5.5 | 0.3 % | ||
| CVE-2024-6840 | fixed in 0:4.5.10-1.el8ap | Automation-controller: gain access to the k8s api server via job execution with container group | MEDIUM 6.6 | 0.4 % | ||
| CVE-2024-1657 | fixed in 0:2.4-6.el8ap | Platform: insecure websocket used when interacting with eda server | HIGH 8.1 | 0.4 % | ||
| CVE-2024-1394 | fixed in 0:1.4.5-1.el8ap | Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads | HIGH 7.5 | 1.5 % | ||
| CVE-2024-0690 | fixed in 1:2.15.9-1.el8ap | Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration | MEDIUM 5.5 | 0.3 % | ||
| CVE-2023-5115 | fixed in 0:2.15.5-1.el8ap | Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files | MEDIUM 6.3 | 1.0 % | ||
| CVE-2023-5764 | fixed in 1:2.15.8-1.el8ap | Ansible: template injection | HIGH 7.8 | 0.5 % | ||
| CVE-2023-5189 | fixed in 0:0.4.18-1.el8ap | Hub: insecure galaxy-importer tarfile extraction | MEDIUM 6.5 | 1.0 % | ||
| CVE-2023-3971 | fixed in 0:4.4.1-1.el8ap | Controller: html injection in custom login info | HIGH 7.3 | 0.8 % | ||
| CVE-2023-4380 | fixed in 0:1.0.1-1.el8ap | Platform: token exposed at importing project | MEDIUM 6.3 | 0.6 % | ||
| CVE-2023-4237 | | Platform: ec2_key module prints out the private key directly to the standard output | HIGH 7.8 | 0.3 % |