agentprime: red-hat-ansible-automation-platform-2-5-for-rhel-8

agentprime: red-hat-ansible-automation-platform-2-5-for-rhel-8Every new CVE for red-hat-ansible-automation-platform-2-5-for-rhel-8.https://agentprime.io/CVE-2026-84724: Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage processhttps://agentprime.io/advisories/CVE-2026-84724/https://agentprime.io/advisories/CVE-2026-84724/CVSS 6.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:40:42 GMTCVECVE-2026-84720: Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oraclehttps://agentprime.io/advisories/CVE-2026-84720/https://agentprime.io/advisories/CVE-2026-84720/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:40:36 GMTCVECVE-2026-84718: Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trusthttps://agentprime.io/advisories/CVE-2026-84718/https://agentprime.io/advisories/CVE-2026-84718/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:40:33 GMTCVECVE-2026-84717: Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templateshttps://agentprime.io/advisories/CVE-2026-84717/https://agentprime.io/advisories/CVE-2026-84717/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:40:32 GMTCVECVE-2026-84716: Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnameshttps://agentprime.io/advisories/CVE-2026-84716/https://agentprime.io/advisories/CVE-2026-84716/CVSS 6.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:40:28 GMTCVECVE-2026-84712: Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membershiphttps://agentprime.io/advisories/CVE-2026-84712/https://agentprime.io/advisories/CVE-2026-84712/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:40:22 GMTCVECVE-2026-84719: Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)https://agentprime.io/advisories/CVE-2026-84719/https://agentprime.io/advisories/CVE-2026-84719/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:40:07 GMTCVEcriticalCVE-2026-84714: Automation-controller: automation-controller: incomplete sanitize_jinja() regex allows jinja template injection into ad-hoc module_args, machine-credential fields, and host names, reaching ansible-co…https://agentprime.io/advisories/CVE-2026-84714/https://agentprime.io/advisories/CVE-2026-84714/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:40:06 GMTCVECVE-2026-84706: Automation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijacking variables (bash_env/ld_preload) allowing code execution i…https://agentprime.io/advisories/CVE-2026-84706/https://agentprime.io/advisories/CVE-2026-84706/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:39:57 GMTCVECVE-2026-75884: Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groupshttps://agentprime.io/advisories/CVE-2026-75884/https://agentprime.io/advisories/CVE-2026-75884/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:39:52 GMTCVEcriticalCVE-2026-84691: Automation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting discloses django secret_key and database credentials to an admi…https://agentprime.io/advisories/CVE-2026-84691/https://agentprime.io/advisories/CVE-2026-84691/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:02:26 GMTCVECVE-2026-84683: Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink sequences (javascript: anchor) enabling…https://agentprime.io/advisories/CVE-2026-84683/https://agentprime.io/advisories/CVE-2026-84683/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 19:02:18 GMTCVECVE-2026-84499: Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplatenode survey min/max validation error m…https://agentprime.io/advisories/CVE-2026-84499/https://agentprime.io/advisories/CVE-2026-84499/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:47:54 GMTCVECVE-2026-84502: Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane podhttps://agentprime.io/advisories/CVE-2026-84502/https://agentprime.io/advisories/CVE-2026-84502/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:47:26 GMTCVEcriticalCVE-2026-84474: Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioni…https://agentprime.io/advisories/CVE-2026-84474/https://agentprime.io/advisories/CVE-2026-84474/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:41:18 GMTCVEcriticalCVE-2026-71465: Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executablehttps://agentprime.io/advisories/CVE-2026-71465/https://agentprime.io/advisories/CVE-2026-71465/CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:29:05 GMTCVECVE-2026-71464: Automation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt bypasses leading-dash git-argument guardhttps://agentprime.io/advisories/CVE-2026-71464/https://agentprime.io/advisories/CVE-2026-71464/CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:29:02 GMTCVECVE-2026-71463: Automation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via conditional gating leaks tracebackshttps://agentprime.io/advisories/CVE-2026-71463/https://agentprime.io/advisories/CVE-2026-71463/CVSS 2.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:28:59 GMTCVECVE-2026-71462: Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control podhttps://agentprime.io/advisories/CVE-2026-71462/https://agentprime.io/advisories/CVE-2026-71462/CVSS 4.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:25:22 GMTCVECVE-2026-71460: Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license details via /config/https://agentprime.io/advisories/CVE-2026-71460/https://agentprime.io/advisories/CVE-2026-71460/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:25:11 GMTCVECVE-2026-71459: Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structurehttps://agentprime.io/advisories/CVE-2026-71459/https://agentprime.io/advisories/CVE-2026-71459/CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:08:04 GMTCVECVE-2026-71458: Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumerationhttps://agentprime.io/advisories/CVE-2026-71458/https://agentprime.io/advisories/CVE-2026-71458/CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 18:07:58 GMTCVECVE-2026-84470: Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level instead of use level, allowing execution-placement authorizatio…https://agentprime.io/advisories/CVE-2026-84470/https://agentprime.io/advisories/CVE-2026-84470/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 01 Sep 2026 20:57:09 GMTCVECVE-2026-71366: Awx: notification backends allow ssrf and credential leakagehttps://agentprime.io/advisories/CVE-2026-71366/https://agentprime.io/advisories/CVE-2026-71366/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 24 Aug 2026 15:42:44 GMTCVECVE-2026-71364: Awx: project archive extraction allows path traversal file writeshttps://agentprime.io/advisories/CVE-2026-71364/https://agentprime.io/advisories/CVE-2026-71364/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 24 Aug 2026 15:21:54 GMTCVECVE-2026-71365: Awx: webhook status callback ssrf leaks the git pathttps://agentprime.io/advisories/CVE-2026-71365/https://agentprime.io/advisories/CVE-2026-71365/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 15:51:10 GMTCVECVE-2026-12564: Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrfhttps://agentprime.io/advisories/CVE-2026-12564/https://agentprime.io/advisories/CVE-2026-12564/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 15:50:54 GMTCVEcriticalCVE-2026-12383: Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dnhttps://agentprime.io/advisories/CVE-2026-12383/https://agentprime.io/advisories/CVE-2026-12383/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 27 Jul 2026 19:12:29 GMTCVECVE-2026-12701: Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexporthttps://agentprime.io/advisories/CVE-2026-12701/https://agentprime.io/advisories/CVE-2026-12701/CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 14:18:18 GMTCVEcriticalCVE-2026-12382: Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofinghttps://agentprime.io/advisories/CVE-2026-12382/https://agentprime.io/advisories/CVE-2026-12382/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 17:21:28 GMTCVECVE-2026-11807: Eda-server: websocket missing authorization allows credential theft via activation_id spoofinghttps://agentprime.io/advisories/CVE-2026-11807/https://agentprime.io/advisories/CVE-2026-11807/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 23 Jun 2026 19:40:33 GMTCVEcriticalCVE-2026-6266: Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linkinghttps://agentprime.io/advisories/CVE-2026-6266/https://agentprime.io/advisories/CVE-2026-6266/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 04 May 2026 13:47:07 GMTCVECVE-2025-9909: Aap-gateway: improper path validation in gateway allows credential exfiltrationhttps://agentprime.io/advisories/CVE-2025-9909/https://agentprime.io/advisories/CVE-2025-9909/CVSS 6.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 27 Feb 2026 07:30:00 GMTCVECVE-2025-9908: Event-driven-ansible: sensitive internal headers disclosure in aap eda event streamshttps://agentprime.io/advisories/CVE-2025-9908/https://agentprime.io/advisories/CVE-2025-9908/CVSS 6.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 27 Feb 2026 07:29:32 GMTCVECVE-2025-9907: Event-driven-ansible: event stream test mode exposes sensitive headers in aap edahttps://agentprime.io/advisories/CVE-2025-9907/https://agentprime.io/advisories/CVE-2025-9907/CVSS 6.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 27 Feb 2026 07:29:06 GMTCVECVE-2025-14025: Ansible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictionshttps://agentprime.io/advisories/CVE-2025-14025/https://agentprime.io/advisories/CVE-2025-14025/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 08 Jan 2026 13:44:04 GMTCVECVE-2025-5988: Aap-gateway: csrf origin checking is disabledhttps://agentprime.io/advisories/CVE-2025-5988/https://agentprime.io/advisories/CVE-2025-5988/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 04 Aug 2025 15:16:43 GMTCVECVE-2025-7738: Python3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aaphttps://agentprime.io/advisories/CVE-2025-7738/https://agentprime.io/advisories/CVE-2025-7738/CVSS 4.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 31 Jul 2025 14:12:02 GMTCVECVE-2025-49520: Event-driven-ansible: authenticated argument injection in git url in eda project creationhttps://agentprime.io/advisories/CVE-2025-49520/https://agentprime.io/advisories/CVE-2025-49520/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 30 Jun 2025 20:45:28 GMTCVECVE-2025-49521: Event-driven-ansible: template injection via git branch and refspec in eda projectshttps://agentprime.io/advisories/CVE-2025-49521/https://agentprime.io/advisories/CVE-2025-49521/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 30 Jun 2025 20:45:13 GMTCVECVE-2025-2877: Event-driven-ansible: exposure inventory passwords in plain text when starting a rulebook activation with verbosity set to debug in edahttps://agentprime.io/advisories/CVE-2025-2877/https://agentprime.io/advisories/CVE-2025-2877/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 28 Mar 2025 14:05:18 GMTCVECVE-2025-1801: Aap-gateway: aap-gateway privilege escalationhttps://agentprime.io/advisories/CVE-2025-1801/https://agentprime.io/advisories/CVE-2025-1801/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 03 Mar 2025 15:03:15 GMTCVECVE-2024-11483: Automation-gateway: aap-gateway: improper scope handling in oauth2 tokens for aap 2.5https://agentprime.io/advisories/CVE-2024-11483/https://agentprime.io/advisories/CVE-2024-11483/CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 25 Nov 2024 03:54:34 GMTCVECVE-2024-10033: Aap-gateway: xss on aap-gatewayhttps://agentprime.io/advisories/CVE-2024-10033/https://agentprime.io/advisories/CVE-2024-10033/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Oct 2024 16:59:43 GMTCVE