Advisories · Technology
Red Hat Ansible Automation Platform 2.7.
Every CVE that names Red Hat Ansible Automation Platform 2.7 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.5 High
Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.7
- Code injection
- CVSS 8.1 High
Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Ansible Automation Platform 2.6
- Path traversal
- CVSS 6.8 Medium
Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Ansible Automation Platform 2.7
- Authentication bypass
- CVSS 6.6 Medium
Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Command injection
- CVSS 6.4 Medium
Automation-controller: automation-controller: email notification backend allows ssrf via user-controlled smtp host/port (internal port-scan oracle, smtp password exfil)
- Red Hat Ansible Automation Platform 2.7
- Red Hat Ansible Automation Platform 2
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracle
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Broken access control
- CVSS 4.3 Medium
Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- CWE-348
- CVSS 5.3 Medium
Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templates
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- CWE-204
- CVSS 6.6 Medium
Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnames
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Privilege escalation
- CVSS 6.5 Medium
Automation-controller: automation-controller: notification.recipients/subject/error lack prevent_search, allowing zero-privilege cross-tenant recovery of notification recipient secrets via filter ora…
- Red Hat Ansible Automation Platform 2.7
- Red Hat Ansible Automation Platform 2
- Broken access control
- CVSS 5.3 Medium
Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Information disclosure
- CVSS 7.2 High
Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslo…
- Red Hat Ansible Automation Platform 2.7
- Red Hat Ansible Automation Platform 2
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Broken access control
- CVSS 7.1 High
Automation-controller: automation-controller: incomplete sanitize_jinja() regex allows jinja template injection into ad-hoc module_args, machine-credential fields, and host names, reaching ansible-co…
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- CWE-184
- CVSS 7.6 High
Automation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijacking variables (bash_env/ld_preload) allowing code execution i…
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- CWE-184
- CVSS 9.1 CriticalCritical · CVSS 9+
Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- CWE-184
- CVSS 8.7 High
Automation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting discloses django secret_key and database credentials to an admi…
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Memory corruption
- CVSS 8.7 High
Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink sequences (javascript: anchor) enabling…
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Cross-site scripting (XSS)
- CVSS 7.7 High
Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplatenode survey min/max validation error m…
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Information disclosure
- CVSS 9.9 CriticalCritical · CVSS 9+
Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane pod
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Command injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioni…
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- CWE-807
- CVSS 8.2 High
Automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (allowany, routed without debug guard) allow advisory-lock starvation…
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Ansible Automation Platform 2.6
- CWE-489
- CVSS 3.1 Low
Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executable
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Command injection
- CVSS 3.1 Low
Automation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt bypasses leading-dash git-argument guard
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Command injection
- CVSS 2.7 Low
Automation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via conditional gating leaks tracebacks
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Information disclosure
- CVSS 4.1 Medium
Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control pod
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- CWE-204
- CVSS 4.3 Medium
Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler
- Red Hat Ansible Automation Platform 2.7
- Red Hat Ansible Automation Platform 2
- Information disclosure
- CVSS 4.3 Medium
Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license details via /config/
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Broken access control
- CVSS 8.5 High
Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job template secret recovery
- Red Hat Ansible Automation Platform 2.7
- Red Hat Ansible Automation Platform 2
- Broken access control
- CVSS 5.0 Medium
Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structure
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Broken access control
- CVSS 5.0 Medium
Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumeration
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- CWE-204
- CVSS 6.4 Medium
Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level instead of use level, allowing execution-placement authorizatio…
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Broken access control
- CVSS 7.7 High
Awx: notification backends allow ssrf and credential leakage
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Server-side request forgery (SSRF)
- CVSS 7.2 High
Awx: project archive extraction allows path traversal file writes
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Path traversal
- CVSS 7.7 High
Awx: webhook status callback ssrf leaks the git pat
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Server-side request forgery (SSRF)
- CVSS 9.6 CriticalCritical · CVSS 9+
Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Server-side request forgery (SSRF)
- CVSS 8.2 High
Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Ansible Automation Platform 2.6
- Weak cryptography or TLS
- CVSS 7.5 High
Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dn
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- CWE-345
- CVSS 9.0 CriticalCritical · CVSS 9+
Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Path traversal
- CVSS 8.2 High
Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Authentication bypass
- CVSS 9.6 CriticalCritical · CVSS 9+
Eda-server: websocket missing authorization allows credential theft via activation_id spoofing
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Broken access control
- CVSS 5.3 Medium
Ansible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expiration
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.7
- Authentication bypass
- CVSS 6.4 Medium
Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions
- Red Hat Ansible Automation Platform 2.16
- Red Hat Ansible Automation Platform 2.18
- Broken access control