Skip to content
Sign in
4.7 Medium

CVE-2026-52902 Awxkit: path traversal via yaml !include directive

Description

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.format yaml import". This is a client-side vulnerability requiring user interaction.

CVSS 3.1 detail

Vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitable with local access to the machine, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Local
Attack complexity
High
Privileges required
None
Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Affected products and versions

Product Affected versions Fixed in
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat Ansible Automation Platform 2.5 for RHEL 8 Versions not published
Red Hat Ansible Automation Platform 2.5 for RHEL 9 Versions not published
Red Hat Ansible Automation Platform 2.6 for RHEL 9 Versions not published
Red Hat Ansible Automation Platform 2.7 for RHEL 10 Versions not published
Red Hat Ansible Automation Platform 2.7 for RHEL 9 Versions not published

Other CVEs of Red Hat Ansible Automation Platform 2

The 211 CVEs of Red Hat Ansible Automation Platform 2 →
CVE-2026-123037 Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902) 6.7 Medium CVE-2026-114236 Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers 3.3 Low CVE-2026-109131 Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl) 5.4 Medium CVE-2026-92982 A flaw was found in Ansible Operator Plugins 8.5 High
Track this CVE