Red Hat Ansible Automation Platform 2 vulnerabilities

59 CVEs affecting Red Hat Ansible Automation Platform 2, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-109131, published 2026-10-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-3727, published 2024-05-14. High severity, CVSS 8.3. EPSS: 1.3% chance of exploitation in the next 30 days. A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion,…
CVE-2026-12701, published 2026-07-20. Critical severity, CVSS 9.0. EPSS: 1.2% chance of exploitation in the next 30 days. A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such…
CVE-2026-1615, published 2026-02-09. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to…
CVE-2024-11831, published 2025-02-10. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object…
CVE-2026-28356, published 2026-03-12. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous…
CVE-2026-31072, published 2026-05-19. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization. The unmarshal_object…
CVE-2026-44189, published 2026-07-22. High severity, CVSS 7.8. EPSS: 1% chance of exploitation in the next 30 days. A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker to craft a malicious playbook filename…
CVE-2026-12398, published 2026-06-16. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the legacy role import API (v1) interpolates unsanitized git ref names (branch/tag names) into shell…
CVE-2026-42561, published 2026-05-13. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing…
CVE-2026-45292, published 2026-05-28. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the…

Latest

CVE-2026-109131, published 2026-10-15. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. The Hub collection module documentation renderer in the unified Ansible Automation Platform UI (built from upstream ansible-ui, frontend/hub) renders a documentation URL part (formatPartURL in…
CVE-2026-92982, published 2026-10-15. High severity, CVSS 8.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values.…
CVE-2026-89091, published 2026-10-08. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation…
CVE-2026-103869, published 2026-10-07. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token download in that worker. A user who…
CVE-2026-103868, published 2026-10-07. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a…
CVE-2026-106033, published 2026-10-06. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application…
CVE-2026-103754, published 2026-10-01. Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in ansible-runner. The unstream_dir() function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates…
CVE-2026-90959, published 2026-09-24. High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days. A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to…
CVE-2026-94416, published 2026-09-24. Medium severity, CVSS 6.8. EPSS: 0.5% chance of exploitation in the next 30 days. An authorization bypass was found in the Ansible Automation Platform (AAP) gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service…
CVE-2026-85475, published 2026-09-23. High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-controlled settings — LOG_AGGREGATOR_HOST,…