CVE-2018-10884: Red Hat Ansible Tower

High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days.

Ansible Tower before versions 3.1.8 and 3.2.6 is vulnerable to cross-site request forgery (CSRF) in awx/api/authentication.py. An attacker could exploit this by tricking already authenticated users into visiting a malicious site and hijacking the authtoken cookie.

Affected products

• Red Hat Ansible Tower: from 3.1.0, up to and including 3.1.8; from 3.2.0, up to and including 3.2.6

Published 2018-08-22. Last modified 2026-06-17.