Red Hat Ansible Automation Platform vulnerabilities

27 CVEs affecting Red Hat Ansible Automation Platform, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-44495, published 2026-06-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability, published 2023-10-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-10-10. EPSS: 100% chance of exploitation in the next 30 days. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability, published 2026-05-26. Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2026-09-02. EPSS: 7.1% chance of exploitation in the next 30 days. Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing…
CVE-2021-20228, published 2021-04-29. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module. This…
CVE-2023-50782, published 2024-02-05. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of…
CVE-2026-44495, published 2026-06-11. High severity, CVSS 7.7. EPSS: 1% chance of exploitation in the next 30 days. Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another…
CVE-2023-5115, published 2023-12-18. Medium severity, CVSS 6.3. EPSS: 1% chance of exploitation in the next 30 days. An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used…
CVE-2026-46625, published 2026-06-10. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the…
CVE-2023-5189, published 2023-11-14. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink…
CVE-2022-2568, published 2022-08-18. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. A privilege escalation flaw was found in the Ansible Automation Platform. This flaw allows a remote authenticated user with 'change user' permissions to modify the account settings of the superuser…
CVE-2021-3583, published 2021-09-22. High severity, CVSS 7.1. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in…

Latest

CVE-2025-57847, published 2026-04-08. Medium severity, CVSS 6.4. EPSS: 0.2% chance of exploitation in the next 30 days. A container privilege escalation flaw was found in certain Ansible Automation Platform images. This issue arises from the /etc/passwd file being created with group-writable permissions during the…
CVE-2025-9909, published 2026-02-27. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of misleading routes using a double-slash…
CVE-2025-9908, published 2026-02-27. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Streams. This vulnerability allows an authenticated user to gain access to sensitive internal…
CVE-2025-9907, published 2026-02-27. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerability allows exposure of sensitive client credentials and internal…
CVE-2025-53862, published 2025-07-11. Low severity, CVSS 3.5. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in Ansible. Three API endpoints are accessible and return verbose, unauthenticated responses. This flaw allows a malicious user to access data that may contain important information.
CVE-2025-53861, published 2025-07-11. Low severity, CVSS 3.1. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in Ansible. Sensitive cookies without security flags over non-encrypted channels can lead to Man-in-the-Middle (MitM) and Cross-site scripting (XSS) attacks allowing attackers to…
CVE-2024-10033, published 2024-10-16. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using…