Red Hat Red Hat Ansible Automation Platform 2.6
40 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-92982 | fixed in 1791840864 | Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection | HIGH 8.5 | 0.5 % | ||
| CVE-2026-90959 | fixed in 1791947385 | Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container regis… | HIGH 8.1 | 0.4 % | ||
| CVE-2026-84724 | fixed in 1789673739 | Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage … | MEDIUM 6.6 | 0.3 % | ||
| CVE-2026-84720 | fixed in 1789673739 | Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifact… | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-84718 | fixed in 1789673739 | Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust | MEDIUM 4.3 | 0.1 % | ||
| CVE-2026-84717 | fixed in 1789673739 | Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webh… | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-84716 | fixed in 1789673739 | Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for cal… | MEDIUM 6.6 | 0.2 % | ||
| CVE-2026-84712 | fixed in 1789673739 | Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-grou… | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-84719 | | Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instanc… | CRITICAL 9.9 | 0.5 % | ||
| CVE-2026-84714 | fixed in 1789673739 | Automation-controller: automation-controller: incomplete sanitize_jinja() regex allows jinja template injection into ad-hoc module_args, … | HIGH 7.1 | 0.3 % | ||
| CVE-2026-84706 | fixed in 1789673739 | Automation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijac… | HIGH 7.6 | 0.3 % | ||
| CVE-2026-75884 | | Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups | CRITICAL 9.1 | 0.4 % | ||
| CVE-2026-84691 | fixed in 1789673739 | Automation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting d… | HIGH 8.7 | 0.2 % | ||
| CVE-2026-84683 | fixed in 1789673739 | Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view vi… | HIGH 8.7 | 0.3 % | ||
| CVE-2026-84499 | fixed in 1789673739 | Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via sche… | HIGH 7.7 | 0.4 % | ||
| CVE-2026-84502 | | Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --u… | CRITICAL 9.9 | 0.6 % | ||
| CVE-2026-84474 | | Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_… | CRITICAL 9.9 | 0.8 % | ||
| CVE-2026-84486 | fixed in 1789673739 | Automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (allowan… | HIGH 8.2 | 0.7 % | ||
| CVE-2026-71465 | fixed in 1789673739 | Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection i… | LOW 3.1 | 0.2 % | ||
| CVE-2026-71464 | fixed in 1789673739 | Automation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt byp… | LOW 3.1 | 0.2 % | ||
| CVE-2026-71463 | fixed in 1789673739 | Automation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via condition… | LOW 2.7 | 0.3 % | ||
| CVE-2026-71462 | fixed in 1789673739 | Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existenc… | MEDIUM 4.1 | 0.3 % | ||
| CVE-2026-71460 | fixed in 1789673739 | Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license … | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-71459 | fixed in 1789673739 | Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass expo… | MEDIUM 5.0 | 0.3 % | ||
| CVE-2026-71458 | fixed in 1789673739 | Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource na… | MEDIUM 5.0 | 0.3 % | ||
| CVE-2026-84470 | fixed in 1789673739 | Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level i… | MEDIUM 6.4 | 0.3 % | ||
| CVE-2026-71366 | fixed in 1787244009 | Awx: notification backends allow ssrf and credential leakage | HIGH 7.7 | 0.6 % | ||
| CVE-2026-71364 | fixed in 1787244009 | Awx: project archive extraction allows path traversal file writes | HIGH 7.2 | 1.7 % | ||
| CVE-2026-71365 | fixed in 1787244009 | Awx: webhook status callback ssrf leaks the git pat | HIGH 7.7 | 0.5 % | ||
| CVE-2026-12564 | | Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf | CRITICAL 9.6 | 0.3 % | ||
| CVE-2026-18141 | fixed in 1785780020 | Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header | HIGH 8.2 | 0.4 % | ||
| CVE-2026-12701 | | Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport | CRITICAL 9.0 | 1.2 % | ||
| CVE-2026-12382 | fixed in 1777311120 | Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing | HIGH 8.2 | 0.5 % | ||
| CVE-2026-11807 | fixed in 1781732675 | Eda-server: websocket missing authorization allows credential theft via activation_id spoofing | CRITICAL 9.6 | 0.5 % | ||
| CVE-2026-44188 | fixed in 1782755166 | Ansible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expiration | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-11332 | | Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution | HIGH 7.8 | 0.2 % | ||
| CVE-2026-6266 | | Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linking | HIGH 8.3 | 0.4 % | ||
| CVE-2025-57847 | | Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions | MEDIUM 6.4 | 0.2 % | ||
| CVE-2026-0598 | fixed in 1777387242 | Ansible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed api | MEDIUM 4.2 | 0.3 % | ||
| CVE-2025-14025 | | Ansible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictions | HIGH 8.5 | 0.4 % |