Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

Red Hat Red Hat Ansible Automation Platform 2.6

40 vulnérabilités publiées citent ce produit.

Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.

CVEVersions vulnérablesTitreSévéritéPubliéeEPSSExploitation
CVE-2026-92982corrigé en 1791840864Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injectionHIGH 8.50.5 %
CVE-2026-90959corrigé en 1791947385Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container regis…HIGH 8.10.4 %
CVE-2026-84724corrigé en 1789673739Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage …MEDIUM 6.60.3 %
CVE-2026-84720corrigé en 1789673739Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifact…MEDIUM 6.50.3 %
CVE-2026-84718corrigé en 1789673739Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trustMEDIUM 4.30.1 %
CVE-2026-84717corrigé en 1789673739Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webh…MEDIUM 5.30.3 %
CVE-2026-84716corrigé en 1789673739Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for cal…MEDIUM 6.60.2 %
CVE-2026-84712corrigé en 1789673739Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-grou…MEDIUM 5.30.4 %
CVE-2026-84719Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instanc…CRITICAL 9.90.5 %
CVE-2026-84714corrigé en 1789673739Automation-controller: automation-controller: incomplete sanitize_jinja() regex allows jinja template injection into ad-hoc module_args, …HIGH 7.10.3 %
CVE-2026-84706corrigé en 1789673739Automation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijac…HIGH 7.60.3 %
CVE-2026-75884Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groupsCRITICAL 9.10.4 %
CVE-2026-84691corrigé en 1789673739Automation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting d…HIGH 8.70.2 %
CVE-2026-84683corrigé en 1789673739Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view vi…HIGH 8.70.3 %
CVE-2026-84499corrigé en 1789673739Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via sche…HIGH 7.70.4 %
CVE-2026-84502Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --u…CRITICAL 9.90.6 %
CVE-2026-84474Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_…CRITICAL 9.90.8 %
CVE-2026-84486corrigé en 1789673739Automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (allowan…HIGH 8.20.7 %
CVE-2026-71465corrigé en 1789673739Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection i…LOW 3.10.2 %
CVE-2026-71464corrigé en 1789673739Automation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt byp…LOW 3.10.2 %
CVE-2026-71463corrigé en 1789673739Automation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via condition…LOW 2.70.3 %
CVE-2026-71462corrigé en 1789673739Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existenc…MEDIUM 4.10.3 %
CVE-2026-71460corrigé en 1789673739Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license …MEDIUM 4.30.2 %
CVE-2026-71459corrigé en 1789673739Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass expo…MEDIUM 5.00.3 %
CVE-2026-71458corrigé en 1789673739Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource na…MEDIUM 5.00.3 %
CVE-2026-84470corrigé en 1789673739Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level i…MEDIUM 6.40.3 %
CVE-2026-71366corrigé en 1787244009Awx: notification backends allow ssrf and credential leakageHIGH 7.70.6 %
CVE-2026-71364corrigé en 1787244009Awx: project archive extraction allows path traversal file writesHIGH 7.21.7 %
CVE-2026-71365corrigé en 1787244009Awx: webhook status callback ssrf leaks the git patHIGH 7.70.5 %
CVE-2026-12564Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrfCRITICAL 9.60.3 %
CVE-2026-18141corrigé en 1785780020Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http headerHIGH 8.20.4 %
CVE-2026-12701Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexportCRITICAL 9.01.2 %
CVE-2026-12382corrigé en 1777311120Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofingHIGH 8.20.5 %
CVE-2026-11807corrigé en 1781732675Eda-server: websocket missing authorization allows credential theft via activation_id spoofingCRITICAL 9.60.5 %
CVE-2026-44188corrigé en 1782755166Ansible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expirationMEDIUM 5.30.3 %
CVE-2026-11332Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code executionHIGH 7.80.2 %
CVE-2026-6266Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linkingHIGH 8.30.4 %
CVE-2025-57847Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissionsMEDIUM 6.40.2 %
CVE-2026-0598corrigé en 1777387242Ansible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed apiMEDIUM 4.20.3 %
CVE-2025-14025Ansible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictionsHIGH 8.50.4 %