Red Hat Red Hat Ansible Automation Platform 2
51 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-114236 | | Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers | LOW 3.3 | 0.1 % | ||
| CVE-2026-109131 | | Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl) | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-92982 | | Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection | HIGH 8.5 | 0.5 % | ||
| CVE-2026-89091 | | Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution | HIGH 8.8 | 0.5 % | ||
| CVE-2026-103869 | | Pulp-ansible: bearer tokens are reused across remotes in a worker | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-103868 | | Pulp-container: registry credentials are reused across remotes in a worker | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-106033 | | Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-103754 | | Ansible-runner: ansible-runner: path traversal and symlink escape in unstream_dir() allows file write outside the target directory | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-90959 | | Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container regis… | HIGH 8.1 | 0.4 % | ||
| CVE-2026-94416 | | Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery | MEDIUM 6.8 | 0.5 % | ||
| CVE-2026-84721 | | Automation-controller: automation-controller: email notification backend allows ssrf via user-controlled smtp host/port (internal port-sc… | MEDIUM 6.4 | 0.3 % | ||
| CVE-2026-84713 | | Automation-controller: automation-controller: notification.recipients/subject/error lack prevent_search, allowing zero-privilege cross-te… | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-85475 | | Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* setti… | HIGH 7.2 | 0.8 % | ||
| CVE-2026-71461 | | Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via ho… | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-76648 | | Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization che… | HIGH 8.5 | 0.4 % | ||
| CVE-2026-42784 | | Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion | HIGH 7.4 | 0.3 % | ||
| CVE-2026-92091 | | Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array | MEDIUM 5.9 | 0.6 % | ||
| CVE-2026-79699 | | Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory | MEDIUM 4.4 | 0.2 % | ||
| CVE-2026-79705 | | Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers | MEDIUM 4.5 | 0.4 % | ||
| CVE-2026-84185 | | Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification | MEDIUM 5.9 | 0.1 % | ||
| CVE-2026-84232 | | Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-80179 | | Jwcrypto: jwcrypto: denial of service via malformed jwe tokens | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-79717 | | Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restriction | MEDIUM 6.4 | 0.4 % | ||
| CVE-2026-19730 | | Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives | MEDIUM 4.2 | 0.1 % | ||
| CVE-2026-18141 | | Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header | HIGH 8.2 | 0.4 % | ||
| CVE-2026-44191 | | Ansible-lightspeed: visual studio code ansible lightspeed extension: remote code execution via command injection in configuration settings | HIGH 7.8 | 0.8 % | ||
| CVE-2026-44187 | | Ansible-lightspeed: ansible lightspeed extension for visual studio code: information disclosure of google gemini api key | LOW 3.3 | 0.1 % | ||
| CVE-2026-44192 | | Ansible-lightspeed: ansible lightspeed mcp server: remote code execution and data exfiltration via path traversal | MEDIUM 6.6 | 0.2 % | ||
| CVE-2026-44190 | | Ansible-lightspeed: ansible lightspeed visual studio code extension: arbitrary code execution via command injection in activation script … | HIGH 7.8 | 0.8 % | ||
| CVE-2026-44189 | | Ansible-lightspeed: visual studio code ansible lightspeed extension: arbitrary code execution via malicious playbook filename | HIGH 7.8 | 1.0 % | ||
| CVE-2026-16544 | | Awx: websocket eventconsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross… | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-16493 | | Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332) | HIGH 7.8 | 0.3 % | ||
| CVE-2026-12701 | | Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport | CRITICAL 9.0 | 1.2 % | ||
| CVE-2026-12726 | | Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credential | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-12398 | | Galaxy_ng: shell injection in legacy role import via unsanitized git ref names | HIGH 7.5 | 0.9 % | ||
| CVE-2026-44188 | | Ansible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expiration | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-52902 | | Awxkit: path traversal via yaml !include directive | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-11332 | | Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution | HIGH 7.8 | 0.2 % | ||
| CVE-2026-6494 | | Aap-mcp-server: aap mcp server: log injection allows social engineering attacks via unsanitized input | MEDIUM 5.3 | 0.3 % | ||
| CVE-2025-57847 | | Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions | MEDIUM 6.4 | 0.2 % | ||
| CVE-2026-0598 | | Ansible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed api | MEDIUM 4.2 | 0.3 % | ||
| CVE-2025-10894 | | Nx: nx/devkit: malicious versions of nx and plugins published to npm | CRITICAL 9.6 | 0.6 % | ||
| CVE-2025-53861 | | Aap: sensitive cookie(s) set without security flags | LOW 3.1 | 0.1 % | ||
| CVE-2025-53862 | | Aap: aap-gateway: automation-hub: sensitive information disclosure | LOW 3.5 | 0.2 % | ||
| CVE-2024-9979 | | Pyo3: risk of use-after-free in `borrowed` reads from python weak references | MEDIUM 5.3 | 0.2 % | ||
| CVE-2024-9620 | | Event-driven automation in ansible automation platform (aap): ansible event-driven automation (eda) lacks encryption | MEDIUM 5.3 | 0.2 % | ||
| CVE-2024-9355 | | Golang-fips: golang fips zeroed buffer | MEDIUM 6.5 | 0.3 % | ||
| CVE-2024-7143 | | Pulpcore: rbac permissions incorrectly assigned in tasks that create objects | HIGH 8.3 | 0.6 % | ||
| CVE-2023-6681 | | Jwcrypto: denail of service via specifically crafted jwe | MEDIUM 5.3 | 0.9 % | ||
| CVE-2023-50782 | | Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659 | HIGH 7.5 | 1.1 % | ||
| CVE-2022-3205 | | Controller: cross site scripting in automation controller ui | MEDIUM 6.1 | 0.5 % |