# Red Hat Ansible Automation Platform 2.7. Every CVE that names Red Hat Ansible Automation Platform 2.7 among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection](https://agentprime.io/advisories/CVE-2026-92982.md) `CVE-2026-92982` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.6 and 4 more · CVSS 8.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Code injection - [Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft](https://agentprime.io/advisories/CVE-2026-90959.md) `CVE-2026-90959` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 and 4 more · CVSS 8.1 High · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal - [Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery](https://agentprime.io/advisories/CVE-2026-94416.md) `CVE-2026-94416` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 and 2 more · CVSS 6.8 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Authentication bypass - [Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process](https://agentprime.io/advisories/CVE-2026-84724.md) `CVE-2026-84724` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 6.6 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [Automation-controller: automation-controller: email notification backend allows ssrf via user-controlled smtp host/port (internal port-scan oracle, smtp password exfil)](https://agentprime.io/advisories/CVE-2026-84721.md) `CVE-2026-84721` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.7 and 1 more · CVSS 6.4 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracle](https://agentprime.io/advisories/CVE-2026-84720.md) `CVE-2026-84720` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control - [Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust](https://agentprime.io/advisories/CVE-2026-84718.md) `CVE-2026-84718` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-348 - [Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templates](https://agentprime.io/advisories/CVE-2026-84717.md) `CVE-2026-84717` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-204 - [Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnames](https://agentprime.io/advisories/CVE-2026-84716.md) `CVE-2026-84716` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 6.6 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Privilege escalation - [Automation-controller: automation-controller: notification.recipients/subject/error lack prevent_search, allowing zero-privilege cross-tenant recovery of notification recipient secrets via filter ora…](https://agentprime.io/advisories/CVE-2026-84713.md) `CVE-2026-84713` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.7 and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control - [Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership](https://agentprime.io/advisories/CVE-2026-84712.md) `CVE-2026-84712` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator\_\* settings leads to remote code execution in the control-plane rsyslo…](https://agentprime.io/advisories/CVE-2026-85475.md) `CVE-2026-85475` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.7 and 1 more · CVSS 7.2 High · Not analysed yet · Published 23 Sept 2026 · Tags: Code injection - [Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)](https://agentprime.io/advisories/CVE-2026-84719.md) `CVE-2026-84719` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 and 4 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control - [Automation-controller: automation-controller: incomplete sanitize_jinja() regex allows jinja template injection into ad-hoc module_args, machine-credential fields, and host names, reaching ansible-co…](https://agentprime.io/advisories/CVE-2026-84714.md) `CVE-2026-84714` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 7.1 High · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-184 - [Automation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijacking variables (bash_env/ld_preload) allowing code execution i…](https://agentprime.io/advisories/CVE-2026-84706.md) `CVE-2026-84706` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 7.6 High · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-184 - [Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups](https://agentprime.io/advisories/CVE-2026-75884.md) `CVE-2026-75884` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 and 4 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-184 - [Automation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting discloses django secret_key and database credentials to an admi…](https://agentprime.io/advisories/CVE-2026-84691.md) `CVE-2026-84691` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 8.7 High · Not analysed yet · Published 23 Sept 2026 · Tags: Memory corruption - [Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink sequences (javascript: anchor) enabling…](https://agentprime.io/advisories/CVE-2026-84683.md) `CVE-2026-84683` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 8.7 High · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS) - [Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplatenode survey min/max validation error m…](https://agentprime.io/advisories/CVE-2026-84499.md) `CVE-2026-84499` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 7.7 High · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into \`git ls-remote --upload-pack\` yields rce on the controller-task control-plane pod](https://agentprime.io/advisories/CVE-2026-84502.md) `CVE-2026-84502` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 and 4 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioni…](https://agentprime.io/advisories/CVE-2026-84474.md) `CVE-2026-84474` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 and 4 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-807 - [Automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (allowany, routed without debug guard) allow advisory-lock starvation…](https://agentprime.io/advisories/CVE-2026-84486.md) `CVE-2026-84486` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 and 2 more · CVSS 8.2 High · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-489 - [Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executable](https://agentprime.io/advisories/CVE-2026-71465.md) `CVE-2026-71465` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 3.1 Low · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [Automation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt bypasses leading-dash git-argument guard](https://agentprime.io/advisories/CVE-2026-71464.md) `CVE-2026-71464` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 3.1 Low · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection - [Automation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via conditional gating leaks tracebacks](https://agentprime.io/advisories/CVE-2026-71463.md) `CVE-2026-71463` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 2.7 Low · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control pod](https://agentprime.io/advisories/CVE-2026-71462.md) `CVE-2026-71462` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 4.1 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-204 - [Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler](https://agentprime.io/advisories/CVE-2026-71461.md) `CVE-2026-71461` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.7 and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Information disclosure - [Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license details via /config/](https://agentprime.io/advisories/CVE-2026-71460.md) `CVE-2026-71460` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control - [Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job template secret recovery](https://agentprime.io/advisories/CVE-2026-76648.md) `CVE-2026-76648` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.7 and 1 more · CVSS 8.5 High · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control - [Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structure](https://agentprime.io/advisories/CVE-2026-71459.md) `CVE-2026-71459` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 5.0 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control - [Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumeration](https://agentprime.io/advisories/CVE-2026-71458.md) `CVE-2026-71458` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 5.0 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-204 - [Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level instead of use level, allowing execution-placement authorizatio…](https://agentprime.io/advisories/CVE-2026-84470.md) `CVE-2026-84470` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 6.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control - [Awx: notification backends allow ssrf and credential leakage](https://agentprime.io/advisories/CVE-2026-71366.md) `CVE-2026-71366` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 7.7 High · Not analysed yet · Published 24 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Awx: project archive extraction allows path traversal file writes](https://agentprime.io/advisories/CVE-2026-71364.md) `CVE-2026-71364` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 7.2 High · Not analysed yet · Published 24 Aug 2026 · Tags: Path traversal - [Awx: webhook status callback ssrf leaks the git pat](https://agentprime.io/advisories/CVE-2026-71365.md) `CVE-2026-71365` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 7.7 High · Not analysed yet · Published 18 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf](https://agentprime.io/advisories/CVE-2026-12564.md) `CVE-2026-12564` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 and 4 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header](https://agentprime.io/advisories/CVE-2026-18141.md) `CVE-2026-18141` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 and 3 more · CVSS 8.2 High · Not analysed yet · Published 31 Jul 2026 · Tags: Weak cryptography or TLS - [Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dn](https://agentprime.io/advisories/CVE-2026-12383.md) `CVE-2026-12383` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 3 more · CVSS 7.5 High · Not analysed yet · Published 27 Jul 2026 · Tags: CWE-345 - [Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport](https://agentprime.io/advisories/CVE-2026-12701.md) `CVE-2026-12701` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jul 2026 · Tags: Path traversal - [Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing](https://agentprime.io/advisories/CVE-2026-12382.md) `CVE-2026-12382` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 8.2 High · Not analysed yet · Published 15 Jul 2026 · Tags: Authentication bypass - [Eda-server: websocket missing authorization allows credential theft via activation_id spoofing](https://agentprime.io/advisories/CVE-2026-11807.md) `CVE-2026-11807` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jun 2026 · Tags: Broken access control - [Ansible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expiration](https://agentprime.io/advisories/CVE-2026-44188.md) `CVE-2026-44188` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.6 and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: Authentication bypass - [Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions](https://agentprime.io/advisories/CVE-2025-57847.md) `CVE-2025-57847` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.16 and 4 more · CVSS 6.4 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Broken access control ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .