Red Hat Ansible Automation Platform 2.

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers

• Red Hat Confidential Compute Attestation
• Red Hat DPU kit for NVIDIA
• Denial of service

Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)

• Red Hat Ansible Automation Platform 2
• Cross-site scripting (XSS)

Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection

• Red Hat Ansible Automation Platform 2.6
• Red Hat Ansible Automation Platform 2.7
• Code injection

Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution

• Red Hat Migration Toolkit for Applications 8
• Red Hat Migration Toolkit for Virtualization
• Path traversal

Pulp-ansible: bearer tokens are reused across remotes in a worker

• Red Hat Ansible Automation Platform 2
• Red Hat Satellite 6
• CWE-488

Pulp-container: registry credentials are reused across remotes in a worker

• Red Hat Ansible Automation Platform 2
• Red Hat Satellite 6
• CWE-488

Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter

• Red Hat Ansible Automation Platform 2
• Red Hat Hardened Images
• Cross-site scripting (XSS)

Ansible-runner: ansible-runner: path traversal and symlink escape in unstream_dir() allows file write outside the target directory

• Red Hat Ansible Automation Platform 2
• Path traversal

Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft

• Red Hat Ansible Automation Platform 2.6 for RHEL 9
• Red Hat Ansible Automation Platform 2.6
• Path traversal

Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery

• Red Hat Ansible Automation Platform 2.6 for RHEL 9
• Red Hat Ansible Automation Platform 2.7
• Authentication bypass

Automation-controller: automation-controller: email notification backend allows ssrf via user-controlled smtp host/port (internal port-scan oracle, smtp password exfil)

• Red Hat Ansible Automation Platform 2.7
• Red Hat Ansible Automation Platform 2
• Server-side request forgery (SSRF)

Automation-controller: automation-controller: notification.recipients/subject/error lack prevent_search, allowing zero-privilege cross-tenant recovery of notification recipient secrets via filter ora…

• Red Hat Ansible Automation Platform 2.7
• Red Hat Ansible Automation Platform 2
• Broken access control

Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslo…

• Red Hat Ansible Automation Platform 2.7
• Red Hat Ansible Automation Platform 2
• Code injection

Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler

• Red Hat Ansible Automation Platform 2.7
• Red Hat Ansible Automation Platform 2
• Information disclosure

Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job template secret recovery

• Red Hat Ansible Automation Platform 2.7
• Red Hat Ansible Automation Platform 2
• Broken access control

Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

• Red Hat Ansible Automation Platform 2.6 for RHEL 9
• Red Hat Enterprise Linux 10
• Weak cryptography or TLS

Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array

• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux 10
• Denial of service

Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory

• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux 10
• Path traversal

Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers

• Red Hat Hardened Images
• Red Hat Ansible Automation Platform 2
• Path traversal

Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification

• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux 10
• Weak cryptography or TLS

Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content

• Red Hat Ansible Automation Platform 2
• Red Hat Satellite 6
• Cross-site scripting (XSS)

Jwcrypto: jwcrypto: denial of service via malformed jwe tokens

• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux 10
• Denial of service

Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restriction

• Red Hat Ansible Automation Platform 2
• Server-side request forgery (SSRF)

Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header

• Red Hat Ansible Automation Platform 2.6 for RHEL 9
• Red Hat Ansible Automation Platform 2.6
• Weak cryptography or TLS

Ansible-lightspeed: visual studio code ansible lightspeed extension: remote code execution via command injection in configuration settings

• Red Hat Ansible Automation Platform 2
• Command injection

Ansible-lightspeed: ansible lightspeed extension for visual studio code: information disclosure of google gemini api key

• Red Hat Ansible Automation Platform 2
• CWE-256

Ansible-lightspeed: ansible lightspeed mcp server: remote code execution and data exfiltration via path traversal

• Red Hat Ansible Automation Platform 2
• Path traversal

Ansible-lightspeed: ansible lightspeed visual studio code extension: arbitrary code execution via command injection in activation script setting

• Red Hat Ansible Automation Platform 2
• Command injection

Ansible-lightspeed: visual studio code ansible lightspeed extension: arbitrary code execution via malicious playbook filename

• Red Hat Ansible Automation Platform 2
• Command injection

Awx: websocket eventconsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure

• Red Hat Ansible Automation Platform 2
• Broken access control

Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)

• Red Hat Satellite 6.17 for RHEL 9
• Red Hat Satellite 6.18 for RHEL 9
• Command injection

Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport

• Red Hat Ansible Automation Platform 2.5 for RHEL 8
• Red Hat Ansible Automation Platform 2.5 for RHEL 9
• Path traversal

Eda-server: websocket missing authorization allows credential theft via activation_id spoofing

• Red Hat Ansible Automation Platform 2.5 for RHEL 8
• Red Hat Ansible Automation Platform 2.5 for RHEL 9
• Broken access control

Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credential

• Red Hat Ansible Automation Platform 2
• Server-side request forgery (SSRF)

Ansible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expiration

• Red Hat Ansible Automation Platform 2.6
• Red Hat Ansible Automation Platform 2.7
• Authentication bypass

Aap-mcp-server: aap mcp server: log injection allows social engineering attacks via unsanitized input

• Red Hat Ansible Automation Platform 2
• Other injection

Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions

• Red Hat Ansible Automation Platform 2.16
• Red Hat Ansible Automation Platform 2.18
• Broken access control

Ansible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed api

• Red Hat Ansible Automation Platform 2.6
• Red Hat Ansible Automation Platform 2
• CWE-283

Nx: nx/devkit: malicious versions of nx and plugins published to npm

• Red Hat Multicluster Global Hub
• Red Hat OpenShift Serverless
• CWE-506

Aap: sensitive cookie(s) set without security flags

• Red Hat Ansible Automation Platform 2
• Weak cryptography or TLS

Aap: aap-gateway: automation-hub: sensitive information disclosure

• Red Hat Ansible Automation Platform 2
• Information disclosure

Event-driven automation in ansible automation platform (aap): ansible event-driven automation (eda) lacks encryption

• Red Hat Ansible Automation Platform 2
• Weak cryptography or TLS

Controller: cross site scripting in automation controller ui

• Red Hat Ansible Automation Platform 1.2
• Red Hat Ansible Automation Platform 2
• Cross-site scripting (XSS)