Known vulnerabilities in Red Hat Ansible Automation Platform 2

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-84683	Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink sequences (javascript: anchor) enabling session takeover	8.7 High	Sep 23, 2026
CVE-2026-84499	Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplatenode survey min/max validation error message	7.7 High	Sep 23, 2026
CVE-2026-84502	Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane pod	9.9 Critical	Sep 23, 2026
CVE-2026-84474	Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioning-callback host match	9.9 Critical	Sep 23, 2026
CVE-2026-84486	Automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (allowany, routed without debug guard) allow advisory-lock starvation of job dispatch (dos)	8.2 High	Sep 23, 2026
CVE-2026-71465	Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executable	3.1 Low	Sep 23, 2026
CVE-2026-71464	Automation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt bypasses leading-dash git-argument guard	3.1 Low	Sep 23, 2026
CVE-2026-71463	Automation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via conditional gating leaks tracebacks	2.7 Low	Sep 23, 2026
CVE-2026-71462	Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control pod	4.1 Medium	Sep 23, 2026
CVE-2026-71461	HostList.list() catches bare Exception and returns str(e) verbatim	4.3 Medium	Sep 23, 2026
CVE-2026-71460	Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license details via /config/	4.3 Medium	Sep 23, 2026
CVE-2026-76648	CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs…	8.5 High	Sep 23, 2026
CVE-2026-71459	Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structure	5.0 Medium	Sep 23, 2026
CVE-2026-71458	Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumeration	5.0 Medium	Sep 23, 2026
CVE-2026-92925	Redis: redis: out-of-bounds read via crafted cluster bus packets	7.1 High	Sep 17, 2026
CVE-2026-42784	Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion	7.4 High	Sep 16, 2026
CVE-2026-92091	Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array	5.9 Medium	Sep 16, 2026
CVE-2026-79699	Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory	4.4 Medium	Sep 15, 2026
CVE-2026-79705	Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers	4.5 Medium	Sep 15, 2026
CVE-2026-84185	Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification	5.9 Medium	Sep 3, 2026
CVE-2026-84470	Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level instead of use level, allowing execution-placement authorization bypass	6.4 Medium	Sep 1, 2026
CVE-2026-84232	Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content	5.4 Medium	Sep 1, 2026
CVE-2026-80179	Jwcrypto: jwcrypto: denial of service via malformed jwe tokens	5.9 Medium	Aug 27, 2026
CVE-2026-79717	Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restriction	6.4 Medium	Aug 25, 2026
CVE-2026-71365	Awx: webhook status callback ssrf leaks the git pat	7.7 High	Aug 18, 2026

Other Red Hat products