Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

Red Hat Red Hat Ansible Automation Platform 2.7

44 vulnérabilités publiées citent ce produit.

Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.

CVEVersions vulnérablesTitreSévéritéPubliéeEPSSExploitation
CVE-2026-92982corrigé en 1792138238Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injectionHIGH 8.50.5 %
CVE-2026-90959corrigé en 1792388670Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container regis…HIGH 8.10.4 %
CVE-2026-94416corrigé en 1792429216Aap-gateway: aap-gateway: authorization bypass via workload identity token forgeryMEDIUM 6.80.5 %
CVE-2026-84724corrigé en 1789580684Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage …MEDIUM 6.60.3 %
CVE-2026-84721corrigé en 1789580684Automation-controller: automation-controller: email notification backend allows ssrf via user-controlled smtp host/port (internal port-sc…MEDIUM 6.40.3 %
CVE-2026-84720corrigé en 1789580684Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifact…MEDIUM 6.50.3 %
CVE-2026-84718corrigé en 1789580684Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trustMEDIUM 4.30.1 %
CVE-2026-84717corrigé en 1789580684Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webh…MEDIUM 5.30.3 %
CVE-2026-84716corrigé en 1789580684Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for cal…MEDIUM 6.60.2 %
CVE-2026-84713corrigé en 1789580684Automation-controller: automation-controller: notification.recipients/subject/error lack prevent_search, allowing zero-privilege cross-te…MEDIUM 6.50.4 %
CVE-2026-84712corrigé en 1789580684Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-grou…MEDIUM 5.30.4 %
CVE-2026-85475corrigé en 1789580684Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* setti…HIGH 7.20.8 %
CVE-2026-84719Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instanc…CRITICAL 9.90.5 %
CVE-2026-84714corrigé en 1789580684Automation-controller: automation-controller: incomplete sanitize_jinja() regex allows jinja template injection into ad-hoc module_args, …HIGH 7.10.3 %
CVE-2026-84706corrigé en 1789580684Automation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijac…HIGH 7.60.3 %
CVE-2026-75884Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groupsCRITICAL 9.10.4 %
CVE-2026-84691corrigé en 1789580684Automation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting d…HIGH 8.70.2 %
CVE-2026-84683corrigé en 1789580684Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view vi…HIGH 8.70.3 %
CVE-2026-84499corrigé en 1789580684Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via sche…HIGH 7.70.4 %
CVE-2026-84502Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --u…CRITICAL 9.90.6 %
CVE-2026-84474Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_…CRITICAL 9.90.8 %
CVE-2026-84486corrigé en 1789580684Automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (allowan…HIGH 8.20.7 %
CVE-2026-71465corrigé en 1789580684Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection i…LOW 3.10.2 %
CVE-2026-71464corrigé en 1789580684Automation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt byp…LOW 3.10.2 %
CVE-2026-71463corrigé en 1789580684Automation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via condition…LOW 2.70.3 %
CVE-2026-71462corrigé en 1789580684Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existenc…MEDIUM 4.10.3 %
CVE-2026-71461corrigé en 1789580684Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via ho…MEDIUM 4.30.4 %
CVE-2026-71460corrigé en 1789580684Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license …MEDIUM 4.30.2 %
CVE-2026-76648corrigé en 1789580684Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization che…HIGH 8.50.4 %
CVE-2026-71459corrigé en 1789580684Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass expo…MEDIUM 5.00.3 %
CVE-2026-71458corrigé en 1789580684Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource na…MEDIUM 5.00.3 %
CVE-2026-84470corrigé en 1789580684Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level i…MEDIUM 6.40.3 %
CVE-2026-71366corrigé en 1787220257Awx: notification backends allow ssrf and credential leakageHIGH 7.70.6 %
CVE-2026-71364corrigé en 1787220257Awx: project archive extraction allows path traversal file writesHIGH 7.21.7 %
CVE-2026-71365corrigé en 1787220257Awx: webhook status callback ssrf leaks the git patHIGH 7.70.5 %
CVE-2026-12564Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrfCRITICAL 9.60.3 %
CVE-2026-18141corrigé en 1785435970Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http headerHIGH 8.20.4 %
CVE-2026-12383corrigé en 1785374869Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dnHIGH 7.50.3 %
CVE-2026-12701Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexportCRITICAL 9.01.2 %
CVE-2026-12382corrigé en 1783919486Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofingHIGH 8.20.5 %
CVE-2026-11807Eda-server: websocket missing authorization allows credential theft via activation_id spoofingCRITICAL 9.60.5 %
CVE-2026-44188corrigé en 1781025813Ansible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expirationMEDIUM 5.30.3 %
CVE-2026-11332Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code executionHIGH 7.80.2 %
CVE-2025-57847Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissionsMEDIUM 6.40.2 %