Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
40 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-90959 | fixed in 0:3.49.71-1.el9ap | Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container regis… | HIGH 8.1 | 0.4 % | ||
| CVE-2026-94416 | fixed in 0:2.6.20261019-1.el9ap | Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery | MEDIUM 6.8 | 0.5 % | ||
| CVE-2026-84724 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage … | MEDIUM 6.6 | 0.3 % | ||
| CVE-2026-84720 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifact… | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-84718 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust | MEDIUM 4.3 | 0.1 % | ||
| CVE-2026-84717 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webh… | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-84716 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for cal… | MEDIUM 6.6 | 0.2 % | ||
| CVE-2026-84712 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-grou… | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-84719 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instanc… | CRITICAL 9.9 | 0.5 % | ||
| CVE-2026-84714 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller: incomplete sanitize_jinja() regex allows jinja template injection into ad-hoc module_args, … | HIGH 7.1 | 0.3 % | ||
| CVE-2026-84706 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijac… | HIGH 7.6 | 0.3 % | ||
| CVE-2026-75884 | fixed in 0:4.7.17-1.el9ap | Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups | CRITICAL 9.1 | 0.4 % | ||
| CVE-2026-84691 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting d… | HIGH 8.7 | 0.2 % | ||
| CVE-2026-84683 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view vi… | HIGH 8.7 | 0.3 % | ||
| CVE-2026-84499 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via sche… | HIGH 7.7 | 0.4 % | ||
| CVE-2026-84502 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --u… | CRITICAL 9.9 | 0.6 % | ||
| CVE-2026-84474 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_… | CRITICAL 9.9 | 0.8 % | ||
| CVE-2026-84486 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (allowan… | HIGH 8.2 | 0.7 % | ||
| CVE-2026-71465 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection i… | LOW 3.1 | 0.2 % | ||
| CVE-2026-71464 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt byp… | LOW 3.1 | 0.2 % | ||
| CVE-2026-71463 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via condition… | LOW 2.7 | 0.3 % | ||
| CVE-2026-71462 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existenc… | MEDIUM 4.1 | 0.3 % | ||
| CVE-2026-71460 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license … | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-71459 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass expo… | MEDIUM 5.0 | 0.3 % | ||
| CVE-2026-71458 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource na… | MEDIUM 5.0 | 0.3 % | ||
| CVE-2026-42784 | fixed in 0:0.1.34-1.el9ap | Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion | HIGH 7.4 | 0.3 % | ||
| CVE-2026-84470 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level i… | MEDIUM 6.4 | 0.3 % | ||
| CVE-2026-71366 | fixed in 0:4.7.16-1.el9ap | Awx: notification backends allow ssrf and credential leakage | HIGH 7.7 | 0.6 % | ||
| CVE-2026-71364 | fixed in 0:4.7.16-1.el9ap | Awx: project archive extraction allows path traversal file writes | HIGH 7.2 | 1.7 % | ||
| CVE-2026-71365 | fixed in 0:4.7.16-1.el9ap | Awx: webhook status callback ssrf leaks the git pat | HIGH 7.7 | 0.5 % | ||
| CVE-2026-12564 | fixed in 0:4.7.17-1.el9ap | Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf | CRITICAL 9.6 | 0.3 % | ||
| CVE-2026-18141 | fixed in 0:1.2.11-1.el9ap | Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header | HIGH 8.2 | 0.4 % | ||
| CVE-2026-12383 | fixed in 0:1.2.11-1.el9ap | Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dn | HIGH 7.5 | 0.3 % | ||
| CVE-2026-12701 | fixed in 0:3.49.63-2.el9ap | Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport | CRITICAL 9.0 | 1.2 % | ||
| CVE-2026-12382 | fixed in 0:2.6.20260422-1.el9ap | Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing | HIGH 8.2 | 0.5 % | ||
| CVE-2026-11807 | fixed in 0:1.2.9-2.el9ap | Eda-server: websocket missing authorization allows credential theft via activation_id spoofing | CRITICAL 9.6 | 0.5 % | ||
| CVE-2026-52902 | fixed in 0:4.7.16-1.el9ap | Awxkit: path traversal via yaml !include directive | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-11332 | fixed in 1:2.16.19-1.el9ap | Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution | HIGH 7.8 | 0.2 % | ||
| CVE-2026-6266 | | Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linking | HIGH 8.3 | 0.4 % | ||
| CVE-2025-14025 | fixed in 0:2.6.20260106-1.el9ap | Ansible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictions | HIGH 8.5 | 0.4 % |