# Red Hat Ansible Automation Platform 2.6 for RHEL 9. Every CVE that names Red Hat Ansible Automation Platform 2.6 for RHEL 9 among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft](https://agentprime.io/advisories/CVE-2026-90959.md) `CVE-2026-90959` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 and 4 more · CVSS 8.1 High · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal - [Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery](https://agentprime.io/advisories/CVE-2026-94416.md) `CVE-2026-94416` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 and 2 more · CVSS 6.8 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Authentication bypass - [Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process](https://agentprime.io/advisories/CVE-2026-84724.md) `CVE-2026-84724` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 6.6 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracle](https://agentprime.io/advisories/CVE-2026-84720.md) `CVE-2026-84720` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control - [Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust](https://agentprime.io/advisories/CVE-2026-84718.md) `CVE-2026-84718` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-348 - [Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templates](https://agentprime.io/advisories/CVE-2026-84717.md) `CVE-2026-84717` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-204 - [Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnames](https://agentprime.io/advisories/CVE-2026-84716.md) `CVE-2026-84716` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 6.6 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Privilege escalation - [Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership](https://agentprime.io/advisories/CVE-2026-84712.md) `CVE-2026-84712` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)](https://agentprime.io/advisories/CVE-2026-84719.md) `CVE-2026-84719` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 and 4 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control - [Automation-controller: automation-controller: incomplete sanitize_jinja() regex allows jinja template injection into ad-hoc module_args, machine-credential fields, and host names, reaching ansible-co…](https://agentprime.io/advisories/CVE-2026-84714.md) `CVE-2026-84714` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 7.1 High · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-184 - [Automation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijacking variables (bash_env/ld_preload) allowing code execution i…](https://agentprime.io/advisories/CVE-2026-84706.md) `CVE-2026-84706` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 7.6 High · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-184 - [Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups](https://agentprime.io/advisories/CVE-2026-75884.md) `CVE-2026-75884` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 and 4 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-184 - [Automation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting discloses django secret_key and database credentials to an admi…](https://agentprime.io/advisories/CVE-2026-84691.md) `CVE-2026-84691` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 8.7 High · Not analysed yet · Published 23 Sept 2026 · Tags: Memory corruption - [Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink sequences (javascript: anchor) enabling…](https://agentprime.io/advisories/CVE-2026-84683.md) `CVE-2026-84683` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 8.7 High · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplatenode survey min/max validation error m…](https://agentprime.io/advisories/CVE-2026-84499.md) `CVE-2026-84499` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 7.7 High · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into \`git ls-remote --upload-pack\` yields rce on the controller-task control-plane pod](https://agentprime.io/advisories/CVE-2026-84502.md) `CVE-2026-84502` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 and 4 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioni…](https://agentprime.io/advisories/CVE-2026-84474.md) `CVE-2026-84474` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 and 4 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-807 - [Automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (allowany, routed without debug guard) allow advisory-lock starvation…](https://agentprime.io/advisories/CVE-2026-84486.md) `CVE-2026-84486` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 and 2 more · CVSS 8.2 High · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-489 - [Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executable](https://agentprime.io/advisories/CVE-2026-71465.md) `CVE-2026-71465` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 3.1 Low · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [Automation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt bypasses leading-dash git-argument guard](https://agentprime.io/advisories/CVE-2026-71464.md) `CVE-2026-71464` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 3.1 Low · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [Automation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via conditional gating leaks tracebacks](https://agentprime.io/advisories/CVE-2026-71463.md) `CVE-2026-71463` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 2.7 Low · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control pod](https://agentprime.io/advisories/CVE-2026-71462.md) `CVE-2026-71462` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 4.1 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-204 - [Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license details via /config/](https://agentprime.io/advisories/CVE-2026-71460.md) `CVE-2026-71460` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control - [Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structure](https://agentprime.io/advisories/CVE-2026-71459.md) `CVE-2026-71459` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 5.0 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control - [Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumeration](https://agentprime.io/advisories/CVE-2026-71458.md) `CVE-2026-71458` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 5.0 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-204 - [Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion](https://agentprime.io/advisories/CVE-2026-42784.md) `CVE-2026-42784` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 and 4 more · CVSS 7.4 High · Not analysed yet · Published 16 Sept 2026 · Tags: Weak cryptography or TLS - [Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level instead of use level, allowing execution-placement authorizatio…](https://agentprime.io/advisories/CVE-2026-84470.md) `CVE-2026-84470` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 6.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control - [Awx: notification backends allow ssrf and credential leakage](https://agentprime.io/advisories/CVE-2026-71366.md) `CVE-2026-71366` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 7.7 High · Not analysed yet · Published 24 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Awx: project archive extraction allows path traversal file writes](https://agentprime.io/advisories/CVE-2026-71364.md) `CVE-2026-71364` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 7.2 High · Not analysed yet · Published 24 Aug 2026 · Tags: Path traversal - [Awx: webhook status callback ssrf leaks the git pat](https://agentprime.io/advisories/CVE-2026-71365.md) `CVE-2026-71365` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 7.7 High · Not analysed yet · Published 18 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf](https://agentprime.io/advisories/CVE-2026-12564.md) `CVE-2026-12564` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 and 4 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header](https://agentprime.io/advisories/CVE-2026-18141.md) `CVE-2026-18141` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 and 3 more · CVSS 8.2 High · Not analysed yet · Published 31 Jul 2026 · Tags: Weak cryptography or TLS - [Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dn](https://agentprime.io/advisories/CVE-2026-12383.md) `CVE-2026-12383` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 3 more · CVSS 7.5 High · Not analysed yet · Published 27 Jul 2026 · Tags: CWE-345 - [Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport](https://agentprime.io/advisories/CVE-2026-12701.md) `CVE-2026-12701` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jul 2026 · Tags: Path traversal - [Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing](https://agentprime.io/advisories/CVE-2026-12382.md) `CVE-2026-12382` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 8.2 High · Not analysed yet · Published 15 Jul 2026 · Tags: Authentication bypass - [Eda-server: websocket missing authorization allows credential theft via activation_id spoofing](https://agentprime.io/advisories/CVE-2026-11807.md) `CVE-2026-11807` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jun 2026 · Tags: Broken access control - [Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linking](https://agentprime.io/advisories/CVE-2026-6266.md) `CVE-2026-6266` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 3 more · CVSS 8.3 High · Not analysed yet · Published 4 May 2026 · Tags: CWE-305 - [Aap-gateway: improper path validation in gateway allows credential exfiltration](https://agentprime.io/advisories/CVE-2025-9909.md) `CVE-2025-9909` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 6.7 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: CWE-647 - [Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams](https://agentprime.io/advisories/CVE-2025-9908.md) `CVE-2025-9908` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 6.7 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Information disclosure - [Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda](https://agentprime.io/advisories/CVE-2025-9907.md) `CVE-2025-9907` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 6.7 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Information disclosure - [Ansible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictions](https://agentprime.io/advisories/CVE-2025-14025.md) `CVE-2025-14025` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 8.5 High · Not analysed yet · Published 8 Jan 2026 · Tags: CWE-279 ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .