What is CVE-2026-12701?

CVE-2026-12701 is a critical-severity vulnerability in Red Hat Ansible Automation Platform 2, classified under Path Traversal. CVSS score: 9.0/10. Published 2026-07-20.

How severe is CVE-2026-12701?

Critical severity. CVSS v3 base score is 9.0 out of 10.

Path Traversal in Red Hat Ansible Automation Platform 2

CVE-2026-12701

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authe…

Vulnerability class: Path Traversal (Directory Traversal)

CVSS v3 metric

CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H.

Affected products

Red Hat Ansible Automation Platform 2
Red Hat Ansible Automation Platform 2.5 For Rhel 8 — versions 0:3.49.63-2.el8ap
Red Hat Ansible Automation Platform 2.5 For Rhel 9 — versions 0:3.49.63-2.el9ap
Red Hat Ansible Automation Platform 2.6 — versions 1783979593
Red Hat Ansible Automation Platform 2.6 For Rhel 9 — versions 0:3.49.63-2.el9ap
Red Hat Ansible Automation Platform 2.7 — versions 1783919521
Red Hat Satellite 6
Red Hat Satellite 6.16 For Rhel 8 — versions 0:3.49.39-2.el8pc
Red Hat Satellite 6.16 For Rhel 9 — versions 0:3.49.39-2.el9pc
Red Hat Satellite 6.17 For Rhel 9 — versions 0:3.63.21-2.el9pc

Weakness classification (CWE)

CWE-22 — Path Traversal

References

secalert@redhat.com (x_refsource_REDHAT, vdb-entry)
secalert@redhat.com (x_refsource_REDHAT, issue-tracking)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)

Frequently asked questions

What is CVE-2026-12701?: CVE-2026-12701 is a critical-severity vulnerability in Red Hat Ansible Automation Platform 2, classified under Path Traversal. CVSS score: 9.0/10. Published 2026-07-20.
How severe is CVE-2026-12701?: Critical severity. CVSS v3 base score is 9.0 out of 10.