Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

49 vulnérabilités publiées citent ce produit.

Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.

CVEVersions vulnérablesTitreSévéritéPubliéeEPSSExploitation
CVE-2026-84724corrigé en 0:4.6.33-1.el8apAutomation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage …MEDIUM 6.60.3 %
CVE-2026-84720corrigé en 0:4.6.33-1.el8apAutomation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifact…MEDIUM 6.50.3 %
CVE-2026-84718corrigé en 0:4.6.33-1.el8apAutomation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trustMEDIUM 4.30.1 %
CVE-2026-84717corrigé en 0:4.6.33-1.el8apAutomation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webh…MEDIUM 5.30.3 %
CVE-2026-84716corrigé en 0:4.6.33-1.el8apAutomation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for cal…MEDIUM 6.60.2 %
CVE-2026-84712corrigé en 0:4.6.33-1.el8apAutomation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-grou…MEDIUM 5.30.4 %
CVE-2026-84719corrigé en 0:4.6.33-1.el8apAutomation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instanc…CRITICAL 9.90.5 %
CVE-2026-84714corrigé en 0:4.6.33-1.el8apAutomation-controller: automation-controller: incomplete sanitize_jinja() regex allows jinja template injection into ad-hoc module_args, …HIGH 7.10.3 %
CVE-2026-84706corrigé en 0:4.6.33-1.el8apAutomation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijac…HIGH 7.60.3 %
CVE-2026-75884corrigé en 0:4.6.33-1.el8apAwx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groupsCRITICAL 9.10.4 %
CVE-2026-84691corrigé en 0:4.6.33-1.el8apAutomation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting d…HIGH 8.70.2 %
CVE-2026-84683corrigé en 0:4.6.33-1.el8apAutomation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view vi…HIGH 8.70.3 %
CVE-2026-84499corrigé en 0:4.6.33-1.el8apAutomation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via sche…HIGH 7.70.4 %
CVE-2026-84502corrigé en 0:4.6.33-1.el8apAutomation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --u…CRITICAL 9.90.6 %
CVE-2026-84474corrigé en 0:4.6.33-1.el8apAutomation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_…CRITICAL 9.90.8 %
CVE-2026-71465corrigé en 0:4.6.33-1.el8apAutomation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection i…LOW 3.10.2 %
CVE-2026-71464corrigé en 0:4.6.33-1.el8apAutomation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt byp…LOW 3.10.2 %
CVE-2026-71463corrigé en 0:4.6.33-1.el8apAutomation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via condition…LOW 2.70.3 %
CVE-2026-71462corrigé en 0:4.6.33-1.el8apAutomation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existenc…MEDIUM 4.10.3 %
CVE-2026-71460corrigé en 0:4.6.33-1.el8apAutomation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license …MEDIUM 4.30.2 %
CVE-2026-71459corrigé en 0:4.6.33-1.el8apAutomation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass expo…MEDIUM 5.00.3 %
CVE-2026-71458corrigé en 0:4.6.33-1.el8apAutomation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource na…MEDIUM 5.00.3 %
CVE-2026-84470corrigé en 0:4.6.33-1.el8apAutomation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level i…MEDIUM 6.40.3 %
CVE-2026-71366corrigé en 0:4.6.32-1.el8apAwx: notification backends allow ssrf and credential leakageHIGH 7.70.6 %
CVE-2026-71364corrigé en 0:4.6.32-1.el8apAwx: project archive extraction allows path traversal file writesHIGH 7.21.7 %
CVE-2026-71365corrigé en 0:4.6.32-1.el8apAwx: webhook status callback ssrf leaks the git patHIGH 7.70.5 %
CVE-2026-12564corrigé en 0:4.6.33-1.el8apAutomation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrfCRITICAL 9.60.3 %
CVE-2026-12383corrigé en 0:1.1.21-1.el8apEda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dnHIGH 7.50.3 %
CVE-2026-12701corrigé en 0:3.49.63-2.el8apPulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexportCRITICAL 9.01.2 %
CVE-2026-12382corrigé en 0:2.5.20260715-1.el8apAap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofingHIGH 8.20.5 %
CVE-2026-11807corrigé en 0:1.1.19-1.el8apEda-server: websocket missing authorization allows credential theft via activation_id spoofingCRITICAL 9.60.5 %
CVE-2026-52902corrigé en 0:4.6.32-1.el8apAwxkit: path traversal via yaml !include directiveMEDIUM 4.70.1 %
CVE-2026-11332corrigé en 1:2.16.19-1.el8apAnsible-core: argument injection in ansible-galaxy role install leads to arbitrary code executionHIGH 7.80.2 %
CVE-2026-6266corrigé en 0:4.6.28-3.el8apAap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linkingHIGH 8.30.4 %
CVE-2025-9909corrigé en 0:3.1.1-1.el8apAap-gateway: improper path validation in gateway allows credential exfiltrationMEDIUM 6.70.2 %
CVE-2025-9908corrigé en 0:3.1.1-1.el8apEvent-driven-ansible: sensitive internal headers disclosure in aap eda event streamsMEDIUM 6.70.2 %
CVE-2025-9907corrigé en 0:3.1.1-1.el8apEvent-driven-ansible: event stream test mode exposes sensitive headers in aap edaMEDIUM 6.70.2 %
CVE-2025-14025corrigé en 0:2.5.20260106-1.el8apAnsible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictionsHIGH 8.50.4 %
CVE-2025-5988corrigé en 0:2.5.20250730-2.el8apAap-gateway: csrf origin checking is disabledMEDIUM 5.30.3 %
CVE-2025-7738corrigé en 0:2.5.20250730-1.el8apPython3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aapMEDIUM 4.40.2 %
CVE-2025-49520corrigé en 0:1.1.11-1.el8apEvent-driven-ansible: authenticated argument injection in git url in eda project creationHIGH 8.80.6 %
CVE-2025-49521corrigé en 0:1.1.11-1.el8apEvent-driven-ansible: template injection via git branch and refspec in eda projectsHIGH 8.80.6 %
CVE-2025-2877corrigé en 0:1.1.4-2.el8apEvent-driven-ansible: exposure inventory passwords in plain text when starting a rulebook activation with verbosity set to debug in edaMEDIUM 6.50.4 %
CVE-2025-1801corrigé en 0:2.5.20250305-1.el8apAap-gateway: aap-gateway privilege escalationHIGH 8.10.3 %
CVE-2024-11483corrigé en 0:2.5.20241218-1.el8apAutomation-gateway: aap-gateway: improper scope handling in oauth2 tokens for aap 2.5MEDIUM 5.00.5 %
CVE-2024-11079Ansible-core: unsafe tagging bypass via hostvars object in ansible-coreMEDIUM 5.50.5 %
CVE-2024-9902Ansible-core: ansible-core user may read/write unauthorized contentMEDIUM 6.30.3 %
CVE-2024-10033corrigé en 0:2.5.3-1.el8apAap-gateway: xss on aap-gatewayMEDIUM 6.10.4 %
CVE-2024-8775Ansible-core: exposure of sensitive information in ansible vault files due to improper loggingMEDIUM 5.50.3 %