Red Hat Red Hat Ansible Automation Platform 2
40 CVEs affecting Red Hat Red Hat Ansible Automation Platform 2. Latest disclosed: 2026-09-01. Critical: 4, High: 15.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12564 | Critical | 9.6 | 2026-08-18 | A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the c… |
CVE-2026-11807 | Critical | 9.6 | 2026-06-23 | A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user… |
CVE-2025-10894 | Critical | 9.6 | 2025-09-24 | Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, vi… |
CVE-2026-12701 | Critical | 9.0 | 2026-07-20 | A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to… |
CVE-2024-7143 | High | 8.3 | 2024-08-07 | A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAdd… |
CVE-2024-3727 | High | 8.3 | 2024-05-14 | A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a vi… |
CVE-2026-18141 | High | 8.2 | 2026-07-31 | A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthenticated remote attacker can bypass mutual… |
CVE-2026-12382 | High | 8.2 | 2026-07-15 | A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requ… |
CVE-2026-44191 | High | 7.8 | 2026-07-22 | A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) arises from improper handling of the ans… |
CVE-2026-44190 | High | 7.8 | 2026-07-22 | A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability (CWE-78) allows a remote attacker to execute unau… |
CVE-2026-44189 | High | 7.8 | 2026-07-22 | A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker t… |
CVE-2026-16493 | High | 7.8 | 2026-07-21 | A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands with… |
CVE-2026-11332 | High | 7.8 | 2026-06-05 | A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to… |
CVE-2026-71366 | High | 7.7 | 2026-08-24 | A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notificat… |
CVE-2026-71365 | High | 7.7 | 2026-08-18 | A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extr… |
CVE-2026-12383 | High | 7.5 | 2026-07-27 | A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowAny], authe… |
CVE-2026-12398 | High | 7.5 | 2026-06-16 | A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the legacy role import API (v1) interpolates unsanitized git ref na… |
CVE-2023-50782 | High | 7.5 | 2024-02-05 | A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchan… |
CVE-2026-71364 | High | 7.2 | 2026-08-24 | A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts zip and tar archive members by joining… |
CVE-2026-44192 | Medium | 6.6 | 2026-07-22 | A flaw was found in the Ansible Lightspeed Model Context Protocol (MCP) server. This vulnerability, known as path traversal, allows an attacker to manipulate a… |