Vulnerabilities of Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-42784	Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion	7.4 High	Sep 16, 2026
CVE-2026-84470	Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level instead of use level, allowing execution-placement authorization bypass	6.4 Medium	Sep 1, 2026
CVE-2026-71366	Awx: notification backends allow ssrf and credential leakage	7.7 High	Aug 24, 2026
CVE-2026-71364	Awx: project archive extraction allows path traversal file writes	7.2 High	Aug 24, 2026
CVE-2026-71365	Awx: webhook status callback ssrf leaks the git pat	7.7 High	Aug 18, 2026
CVE-2026-12564	Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf	9.6 Critical	Aug 18, 2026
CVE-2026-18141	A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA)	8.2 High	Jul 31, 2026
CVE-2026-12383	A flaw was found in the Event-Driven Ansible (EDA) server	7.5 High	Jul 27, 2026
CVE-2026-12701	A path traversal vulnerability was found in pulpcore	9.0 Critical	Jul 20, 2026
CVE-2026-12382	A flaw was found in the AAP Gateway Envoy proxy configuration	8.2 High	Jul 15, 2026
CVE-2026-11807	Eda-server: websocket missing authorization allows credential theft via activation_id spoofing	9.6 Critical	Jun 23, 2026
CVE-2026-12143	form-data is a library for creating readable multipart/form-data streams	8.7 High	Jun 12, 2026
CVE-2026-44488	Axios is a promise based HTTP client for the browser and Node.js	7.5 High	Jun 11, 2026
CVE-2026-44495	Axios is a promise based HTTP client for the browser and Node.js	7.0 High	Jun 11, 2026
CVE-2026-52902	Awxkit: path traversal via yaml !include directive	4.7 Medium	Jun 9, 2026
CVE-2026-11332	Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution	7.8 High	Jun 5, 2026
CVE-2026-27145	(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name…	6.5 Medium	Jun 2, 2026
CVE-2026-34993	AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python	6.4 Medium	Jun 2, 2026
CVE-2026-8643	pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved…	4.1 Medium	Jun 1, 2026
CVE-2026-48526	PyJWT is a JSON Web Token implementation in Python	7.4 High	May 28, 2026
CVE-2026-39821	The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label	9.6 Critical	May 22, 2026
CVE-2026-44432	urllib3 is an HTTP client library for Python	8.9 High	May 13, 2026
CVE-2026-44293	protobufjs compiles protobuf definitions into JavaScript (JS) functions	7.7 High	May 13, 2026
CVE-2026-33811	When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a…	7.5 High	May 7, 2026
CVE-2026-39820	Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion…	7.5 High	May 7, 2026

Other Red Hat products