Red Hat Ansible Automation Platform 2.7 vulnerabilities

43 CVEs affecting Red Hat Ansible Automation Platform 2.7, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-85475, published 2026-09-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-71364, published 2026-08-24. High severity, CVSS 7.2. EPSS: 1.7% chance of exploitation in the next 30 days. A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts zip and tar archive members by joining the project directory path with the…
CVE-2026-12701, published 2026-07-20. Critical severity, CVSS 9.0. EPSS: 1.2% chance of exploitation in the next 30 days. A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such…
CVE-2026-42561, published 2026-05-13. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing…
CVE-2026-84474, published 2026-09-23. Critical severity, CVSS 9.9. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret (host_config_key) is exposed to users holding only the read-level view_jobtemplate…
CVE-2026-12143, published 2026-06-12. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into…
CVE-2026-84502, published 2026-09-23. Critical severity, CVSS 9.9. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not validated against values that begin with a dash and is stored and passed verbatim to…
CVE-2026-27145, published 2026-06-02. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the…
CVE-2026-71366, published 2026-08-24. High severity, CVSS 7.7. EPSS: 0.6% chance of exploitation in the next 30 days. A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template…
CVE-2026-11807, published 2026-06-23. Critical severity, CVSS 9.6. EPSS: 0.5% chance of exploitation in the next 30 days. A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker…
CVE-2026-84486, published 2026-09-23. High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views that trigger the internal task, dependency, and workflow schedulers are configured to allow any user…

Latest

CVE-2026-85475, published 2026-09-23. High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-controlled settings — LOG_AGGREGATOR_HOST,…
CVE-2026-84724, published 2026-09-23. Medium severity, CVSS 6.6. EPSS: 0.3% chance of exploitation in the next 30 days. An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable…
CVE-2026-84721, published 2026-09-23. Medium severity, CVSS 6.4. EPSS: 0.2% chance of exploitation in the next 30 days. A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend passes the user-supplied SMTP host and port from a…
CVE-2026-84720, published 2026-09-23. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which stores the raw merged set_stats artifacts propagated between…
CVE-2026-84719, published 2026-09-23. Critical severity, CVSS 9.9. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template,…
CVE-2026-84718, published 2026-09-23. Medium severity, CVSS 4.3. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's…
CVE-2026-84717, published 2026-09-23. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events…
CVE-2026-84716, published 2026-09-23. Medium severity, CVSS 6.6. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the…
CVE-2026-84714, published 2026-09-23. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular expressions to reject user-supplied Jinja, but…
CVE-2026-84713, published 2026-09-23. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ configuration is protected from API filtering,…