Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
49 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-84724 | fixed in 0:4.6.33-1.el8ap | Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage … | MEDIUM 6.6 | 0.3 % | ||
| CVE-2026-84720 | fixed in 0:4.6.33-1.el8ap | Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifact… | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-84718 | fixed in 0:4.6.33-1.el8ap | Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust | MEDIUM 4.3 | 0.1 % | ||
| CVE-2026-84717 | fixed in 0:4.6.33-1.el8ap | Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webh… | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-84716 | fixed in 0:4.6.33-1.el8ap | Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for cal… | MEDIUM 6.6 | 0.2 % | ||
| CVE-2026-84712 | fixed in 0:4.6.33-1.el8ap | Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-grou… | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-84719 | fixed in 0:4.6.33-1.el8ap | Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instanc… | CRITICAL 9.9 | 0.5 % | ||
| CVE-2026-84714 | fixed in 0:4.6.33-1.el8ap | Automation-controller: automation-controller: incomplete sanitize_jinja() regex allows jinja template injection into ad-hoc module_args, … | HIGH 7.1 | 0.3 % | ||
| CVE-2026-84706 | fixed in 0:4.6.33-1.el8ap | Automation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijac… | HIGH 7.6 | 0.3 % | ||
| CVE-2026-75884 | fixed in 0:4.6.33-1.el8ap | Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups | CRITICAL 9.1 | 0.4 % | ||
| CVE-2026-84691 | fixed in 0:4.6.33-1.el8ap | Automation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting d… | HIGH 8.7 | 0.2 % | ||
| CVE-2026-84683 | fixed in 0:4.6.33-1.el8ap | Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view vi… | HIGH 8.7 | 0.3 % | ||
| CVE-2026-84499 | fixed in 0:4.6.33-1.el8ap | Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via sche… | HIGH 7.7 | 0.4 % | ||
| CVE-2026-84502 | fixed in 0:4.6.33-1.el8ap | Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --u… | CRITICAL 9.9 | 0.6 % | ||
| CVE-2026-84474 | fixed in 0:4.6.33-1.el8ap | Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_… | CRITICAL 9.9 | 0.8 % | ||
| CVE-2026-71465 | fixed in 0:4.6.33-1.el8ap | Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection i… | LOW 3.1 | 0.2 % | ||
| CVE-2026-71464 | fixed in 0:4.6.33-1.el8ap | Automation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt byp… | LOW 3.1 | 0.2 % | ||
| CVE-2026-71463 | fixed in 0:4.6.33-1.el8ap | Automation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via condition… | LOW 2.7 | 0.3 % | ||
| CVE-2026-71462 | fixed in 0:4.6.33-1.el8ap | Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existenc… | MEDIUM 4.1 | 0.3 % | ||
| CVE-2026-71460 | fixed in 0:4.6.33-1.el8ap | Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license … | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-71459 | fixed in 0:4.6.33-1.el8ap | Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass expo… | MEDIUM 5.0 | 0.3 % | ||
| CVE-2026-71458 | fixed in 0:4.6.33-1.el8ap | Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource na… | MEDIUM 5.0 | 0.3 % | ||
| CVE-2026-84470 | fixed in 0:4.6.33-1.el8ap | Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level i… | MEDIUM 6.4 | 0.3 % | ||
| CVE-2026-71366 | fixed in 0:4.6.32-1.el8ap | Awx: notification backends allow ssrf and credential leakage | HIGH 7.7 | 0.6 % | ||
| CVE-2026-71364 | fixed in 0:4.6.32-1.el8ap | Awx: project archive extraction allows path traversal file writes | HIGH 7.2 | 1.7 % | ||
| CVE-2026-71365 | fixed in 0:4.6.32-1.el8ap | Awx: webhook status callback ssrf leaks the git pat | HIGH 7.7 | 0.5 % | ||
| CVE-2026-12564 | fixed in 0:4.6.33-1.el8ap | Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf | CRITICAL 9.6 | 0.3 % | ||
| CVE-2026-12383 | fixed in 0:1.1.21-1.el8ap | Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dn | HIGH 7.5 | 0.3 % | ||
| CVE-2026-12701 | fixed in 0:3.49.63-2.el8ap | Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport | CRITICAL 9.0 | 1.2 % | ||
| CVE-2026-12382 | fixed in 0:2.5.20260715-1.el8ap | Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing | HIGH 8.2 | 0.5 % | ||
| CVE-2026-11807 | fixed in 0:1.1.19-1.el8ap | Eda-server: websocket missing authorization allows credential theft via activation_id spoofing | CRITICAL 9.6 | 0.5 % | ||
| CVE-2026-52902 | fixed in 0:4.6.32-1.el8ap | Awxkit: path traversal via yaml !include directive | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-11332 | fixed in 1:2.16.19-1.el8ap | Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution | HIGH 7.8 | 0.2 % | ||
| CVE-2026-6266 | fixed in 0:4.6.28-3.el8ap | Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linking | HIGH 8.3 | 0.4 % | ||
| CVE-2025-9909 | fixed in 0:3.1.1-1.el8ap | Aap-gateway: improper path validation in gateway allows credential exfiltration | MEDIUM 6.7 | 0.2 % | ||
| CVE-2025-9908 | fixed in 0:3.1.1-1.el8ap | Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams | MEDIUM 6.7 | 0.2 % | ||
| CVE-2025-9907 | fixed in 0:3.1.1-1.el8ap | Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda | MEDIUM 6.7 | 0.2 % | ||
| CVE-2025-14025 | fixed in 0:2.5.20260106-1.el8ap | Ansible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictions | HIGH 8.5 | 0.4 % | ||
| CVE-2025-5988 | fixed in 0:2.5.20250730-2.el8ap | Aap-gateway: csrf origin checking is disabled | MEDIUM 5.3 | 0.3 % | ||
| CVE-2025-7738 | fixed in 0:2.5.20250730-1.el8ap | Python3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aap | MEDIUM 4.4 | 0.2 % | ||
| CVE-2025-49520 | fixed in 0:1.1.11-1.el8ap | Event-driven-ansible: authenticated argument injection in git url in eda project creation | HIGH 8.8 | 0.6 % | ||
| CVE-2025-49521 | fixed in 0:1.1.11-1.el8ap | Event-driven-ansible: template injection via git branch and refspec in eda projects | HIGH 8.8 | 0.6 % | ||
| CVE-2025-2877 | fixed in 0:1.1.4-2.el8ap | Event-driven-ansible: exposure inventory passwords in plain text when starting a rulebook activation with verbosity set to debug in eda | MEDIUM 6.5 | 0.4 % | ||
| CVE-2025-1801 | fixed in 0:2.5.20250305-1.el8ap | Aap-gateway: aap-gateway privilege escalation | HIGH 8.1 | 0.3 % | ||
| CVE-2024-11483 | fixed in 0:2.5.20241218-1.el8ap | Automation-gateway: aap-gateway: improper scope handling in oauth2 tokens for aap 2.5 | MEDIUM 5.0 | 0.5 % | ||
| CVE-2024-11079 | | Ansible-core: unsafe tagging bypass via hostvars object in ansible-core | MEDIUM 5.5 | 0.5 % | ||
| CVE-2024-9902 | | Ansible-core: ansible-core user may read/write unauthorized content | MEDIUM 6.3 | 0.3 % | ||
| CVE-2024-10033 | fixed in 0:2.5.3-1.el8ap | Aap-gateway: xss on aap-gateway | MEDIUM 6.1 | 0.4 % | ||
| CVE-2024-8775 | | Ansible-core: exposure of sensitive information in ansible vault files due to improper logging | MEDIUM 5.5 | 0.3 % |