Red Hat Ansible Automation Platform 2.6 vulnerabilities

43 CVEs affecting Red Hat Ansible Automation Platform 2.6, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-84724, published 2026-09-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-71364, published 2026-08-24. High severity, CVSS 7.2. EPSS: 1.7% chance of exploitation in the next 30 days. A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts zip and tar archive members by joining the project directory path with the…
CVE-2026-12701, published 2026-07-20. Critical severity, CVSS 9.0. EPSS: 1.2% chance of exploitation in the next 30 days. A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such…
CVE-2026-1615, published 2026-02-09. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to…
CVE-2026-31812, published 2026-03-10. Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days. Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using…
CVE-2026-42561, published 2026-05-13. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing…
CVE-2026-84474, published 2026-09-23. Critical severity, CVSS 9.9. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret (host_config_key) is exposed to users holding only the read-level view_jobtemplate…
CVE-2026-12143, published 2026-06-12. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into…
CVE-2026-84502, published 2026-09-23. Critical severity, CVSS 9.9. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not validated against values that begin with a dash and is stored and passed verbatim to…
CVE-2026-6266, published 2026-05-04. High severity, CVSS 8.3. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on…
CVE-2026-71366, published 2026-08-24. High severity, CVSS 7.7. EPSS: 0.6% chance of exploitation in the next 30 days. A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template…

Latest

CVE-2026-84724, published 2026-09-23. Medium severity, CVSS 6.6. EPSS: 0.3% chance of exploitation in the next 30 days. An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable…
CVE-2026-84720, published 2026-09-23. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which stores the raw merged set_stats artifacts propagated between…
CVE-2026-84719, published 2026-09-23. Critical severity, CVSS 9.9. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template,…
CVE-2026-84718, published 2026-09-23. Medium severity, CVSS 4.3. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's…
CVE-2026-84717, published 2026-09-23. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events…
CVE-2026-84716, published 2026-09-23. Medium severity, CVSS 6.6. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the…
CVE-2026-84714, published 2026-09-23. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular expressions to reject user-supplied Jinja, but…
CVE-2026-84712, published 2026-09-23. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes RBAC-gated …
CVE-2026-84706, published 2026-09-23. High severity, CVSS 7.6. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names against a deny-list (an ANSIBLE_* prefix…
CVE-2026-84691, published 2026-09-23. High severity, CVSS 8.7. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors is an administrator-controlled Python…