Redhat Ansible_automation_platform
25 CVEs affecting Redhat Ansible_automation_platform. Latest disclosed: 2026-04-08. Critical: 0, High: 9.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-4112 | High | 8.8 | 2022-08-25 | A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege f… |
CVE-2024-7143 | High | 8.3 | 2024-08-07 | A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAdd… |
CVE-2023-50782 | High | 7.5 | 2024-02-05 | A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchan… |
CVE-2023-44487 | High | 7.5 | 2023-10-10 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w… |
CVE-2021-20228 | High | 7.5 | 2021-04-29 | A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-opti… |
CVE-2023-4237 | High | 7.3 | 2023-10-04 | A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output… |
CVE-2023-3971 | High | 7.3 | 2023-10-04 | An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login p… |
CVE-2023-5764 | High | 7.1 | 2023-12-12 | A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. T… |
CVE-2021-3583 | High | 7.1 | 2021-09-22 | A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user… |
CVE-2025-9909 | Medium | 6.7 | 2026-02-27 | A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of mi… |
CVE-2025-9908 | Medium | 6.7 | 2026-02-27 | A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Streams. This vulnerability allows an authenticated user to gain… |
CVE-2025-9907 | Medium | 6.7 | 2026-02-27 | A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerability allows exposure of sensitive clien… |
CVE-2022-1632 | Medium | 6.5 | 2022-09-01 | An Improper Certificate Validation attack was found in Openshift. A re-encrypt Route with destinationCACertificate explicitly set to the default serviceCA skip… |
CVE-2022-2568 | Medium | 6.5 | 2022-08-18 | A privilege escalation flaw was found in the Ansible Automation Platform. This flaw allows a remote authenticated user with 'change user' permissions to modify… |
CVE-2025-57847 | Medium | 6.4 | 2026-04-08 | A container privilege escalation flaw was found in certain Ansible Automation Platform images. This issue arises from the /etc/passwd file being created with g… |
CVE-2023-5115 | Medium | 6.3 | 2023-12-18 | An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim… |
CVE-2023-5189 | Medium | 6.3 | 2023-11-14 | A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer o… |
CVE-2023-4380 | Medium | 6.3 | 2023-10-04 | A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw a… |
CVE-2024-10033 | Medium | 6.1 | 2024-10-16 | A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perf… |
CVE-2022-3644 | Medium | 5.5 | 2022-10-25 | The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () in… |