Known vulnerabilities in Red Hat Ansible Automation Platform 2.5 for RHEL 9

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-27606	Rollup is a module bundler for JavaScript	8.8 High	Feb 25, 2026
CVE-2026-25990	Pillow is a Python imaging library	8.6 High	Feb 11, 2026
CVE-2025-69873	ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the…	2.9 Low	Feb 11, 2026
CVE-2026-26007	cryptography is a package designed to expose cryptographic primitives and recipes to Python developers	8.2 High	Feb 10, 2026
CVE-2026-1312	An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28	Not rated	Feb 3, 2026
CVE-2026-1287	An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28	Not rated	Feb 3, 2026
CVE-2026-1207	An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28	Not rated	Feb 3, 2026
CVE-2025-61726	The net/url package does not set a limit on the number of query parameters in a query	7.5 High	Jan 28, 2026
CVE-2026-0994	A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the…	8.2 High	Jan 23, 2026
CVE-2026-24049	wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427	7.1 High	Jan 22, 2026
CVE-2026-23490	pyasn1 is a generic ASN.1 library for Python	7.5 High	Jan 16, 2026
CVE-2026-22029	React Router is a router for React	8.0 High	Jan 10, 2026
CVE-2025-14025	A flaw was found in Ansible Automation Platform (AAP)	8.5 High	Jan 8, 2026
CVE-2025-69223	AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python	7.5 High	Jan 5, 2026
CVE-2025-5988	Aap-gateway: csrf origin checking is disabled	5.3 Medium	Aug 4, 2025
CVE-2025-7738	A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub…	4.4 Medium	Jul 31, 2025
CVE-2025-49520	A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to…	8.8 High	Jun 30, 2025
CVE-2025-49521	A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec…	8.8 High	Jun 30, 2025
CVE-2025-2877	A flaw was found in the Ansible Automation Platform's Event-Driven Ansible	6.5 Medium	Mar 28, 2025
CVE-2025-1801	Aap-gateway: aap-gateway privilege escalation	8.1 High	Mar 3, 2025
CVE-2024-11483	A vulnerability was found in the Ansible Automation Platform (AAP)	5.0 Medium	Nov 25, 2024
CVE-2024-11079	Ansible-core: unsafe tagging bypass via hostvars object in ansible-core	5.5 Medium	Nov 11, 2024
CVE-2024-9902	Ansible-core: ansible-core user may read/write unauthorized content	6.3 Medium	Nov 6, 2024
CVE-2024-10033	Aap-gateway: xss on aap-gateway	6.1 Medium	Oct 16, 2024
CVE-2024-8775	Ansible-core: exposure of sensitive information in ansible vault files due to improper logging	5.5 Medium	Sep 14, 2024

Other Red Hat products