Red Hat Linux OS and other open source products
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Red Hat product.
RSS Feeds for Red Hat security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Red Hat products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Red Hat Sorted by Most Security Vulnerabilities since 2018
Red Hat Enterprise Linux Server1534 vulnerabilities
RedHat Enterprise Linux (RHEL) Server. Includes software bundeled with RHEL server.
Red Hat Enterprise Linux Workstation1504 vulnerabilities
RedHat Enterprise Linux (RHEL) Workstation. Includes software bundled with RHEL Workstation.
Red Hat Enterprise Linux Desktop1493 vulnerabilities
RedHat Enterprise Linux (RHEL) Desktop. Includes software bundled with RHEL desktop
Recent Red Hat Security Advisories
| Advisory | Title | Published |
|---|---|---|
| RHSA-2026:71700 | (RHSA-2026:71700) Important: kernel security, bug fix, and enhancement update | September 25, 2026 |
| RHSA-2026:71687 | (RHSA-2026:71687) Important: kernel security update | September 24, 2026 |
| RHSA-2026:67856 | (RHSA-2026:67856) Important: OpenShift Container Platform 4.15.69 packages and security update | September 24, 2026 |
| RHSA-2026:71675 | (RHSA-2026:71675) Important: Red Hat Build of Apache Camel 4.18.4 for Spring Boot release. | September 24, 2026 |
| RHSA-2026:71659 | (RHSA-2026:71659) Important: python-cryptography security update | September 24, 2026 |
| RHSA-2026:71658 | (RHSA-2026:71658) Important: python-cryptography security update | September 24, 2026 |
| RHSA-2026:71657 | (RHSA-2026:71657) Important: kernel-rt security update | September 24, 2026 |
| RHSA-2026:71656 | (RHSA-2026:71656) Important: acl security update | September 24, 2026 |
| RHSA-2026:71655 | (RHSA-2026:71655) Red Hat Hardened Images RPMs Security Update | September 24, 2026 |
| RHSA-2026:71652 | (RHSA-2026:71652) Important: firefox security update | September 24, 2026 |
By the Year
In 2026 there have been 3685 vulnerabilities in Red Hat with an average score of 7.2 out of ten. Last year, in 2025 Red Hat had 1184 security vulnerabilities published. That is, 2501 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.38.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 3685 | 7.25 |
| 2025 | 1184 | 6.86 |
| 2024 | 1695 | 6.82 |
| 2023 | 1207 | 6.75 |
| 2022 | 1362 | 6.96 |
| 2021 | 1123 | 6.61 |
| 2020 | 664 | 6.39 |
| 2019 | 772 | 6.98 |
| 2018 | 760 | 7.16 |
It may take a day or so for new Red Hat vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-90959 | Sep 24, 2026 |
A path traversal vulnerability was found in pulpcoreA path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects URLs beginning with 'file://', but Python's URL parser recognizes the 'file:' scheme without double slashes, creating a mismatch between what is validated and what is dispatched to the file downloader. An authenticated user with low-privilege repository permissions can supply a specially crafted URL using relative path traversal sequences to read any file accessible to the Pulp server process. In deployments that include Pulp Container, successful exploitation allows an attacker to read the container registry token signing private key and forge bearer tokens, granting unauthorized access to all private container repositories in the affected registry. |
Ansible Automation Platform
Satellite
Rhui
And others... |
| CVE-2026-77874 | Sep 24, 2026 |
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injectionIBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database. |
|
| CVE-2026-95521 | Sep 24, 2026 |
A command injection flaw was found in rpmA command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm. |
Enterprise Linux (RHEL)
Hummingbird
|
| CVE-2026-95519 | Sep 24, 2026 |
A flaw was found in rpmA flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account. |
Enterprise Linux (RHEL)
Hummingbird
|
| CVE-2026-94416 | Sep 24, 2026 |
Authorization Bypass in Red Hat Ansible Automation Platform GatewayAn authorization bypass was found in the Ansible Automation Platform (AAP) gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. Because service-key creation is not restricted to the installer-provisioned provisioning path, an administrator-issued key is cryptographically indistinguishable from a legitimate one and can be used to forge a service-authentication token that impersonates the Controller service. Combined with the gateway OIDC workload-identity endpoint (enabled via FEATURE_OIDC_WORKLOAD_IDENTITY_ENABLED), the attacker can drive the gateway to sign Workload Identity Tokens (WITs) for arbitrary Controller workloads. A downstream resource server such as HashiCorp Vault that trusts the gateway OIDC key will accept the forged WIT and return the AAP credentials bound to that workload, disclosing secrets beyond the attacker's authorization boundary. |
Ansible Automation Platform
|
| CVE-2026-97311 | Sep 24, 2026 |
Keycloak Admin REST API Bypass Group Visibility PermissionsA flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileges to view detailed information about all groups assigned to a role, bypassing intended security restrictions that should limit their view to specific groups. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-97185 | Sep 24, 2026 |
GIMP OOB Write via Malicious GIMPressionist PresetA flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution. |
Enterprise Linux (RHEL)
|
| CVE-2026-97177 | Sep 24, 2026 |
Keycloak Admin REST API Password Reset Bypass via User UpdateA flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted from resetting passwords, to change a user's credentials and take over their account. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-97176 | Sep 24, 2026 |
Keycloak Auth Level Enforcement BypassA flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how session re-evaluations are handled, Keycloak may incorrectly issue a token at the lower security level instead of enforcing the required higher level, potentially allowing unauthorized access to sensitive resources that rely on these security claims. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-75887 | Sep 23, 2026 |
OpenShift Console Path Traversal via lng/ns on /locales/resource.jsonA flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json` files from the pod filesystem, including plugin manifests and configuration files. Furthermore, this flaw can enable path traversal against registered dynamic-plugin backends. |
Openshift
|
| CVE-2026-75886 | Sep 23, 2026 |
OpenShift Console CatalogdHandler Auth Bypass & Cookie ForwardingA flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send requests to the in-cluster catalogd service, leading to the disclosure of the internal operator-catalog index and providing a relay into the openshift-catalogd namespace. |
Openshift
|
| CVE-2026-84724 | Sep 23, 2026 |
Arg Injection in Ansible Automation Platform Automation Controller System-JobAn argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens the management-command argument list into a single string with spaces before the job runner re-splits it, so spaces in the value become additional command-line arguments. Because system jobs are executed in-process on the control node without the container isolation applied to all other job types, an authenticated user with superuser privileges can inject arbitrary arguments including Python's path option into the control-plane awx-manage process, controlling its argument vector and the first entry of its module search path. Full remote code execution requires an additional import gadget that is not present in the current management commands, so the demonstrated impact is argument injection with control of the process search path rather than confirmed code execution. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-84721 | Sep 23, 2026 |
SSRF in Ansible Automation Platform Email Backend Enables Internal Port ScanA server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend passes the user-supplied SMTP host and port from a notification template directly to the SMTP client without validating that the target is not an internal, loopback, link-local, or reserved address. An authenticated user with organization notification-admin permission can create or modify an email notification template pointing at an arbitrary internal address, trigger a test, and have the controller task process open a raw TCP connection to that address. The resulting connection error is reflected back through the notification record, providing a three-state internal port-scan oracle (open, closed, filtered) over the control-plane's cluster network, including the in-cluster Kubernetes API. When a shared organization template holds a stored SMTP password, redirecting the host can also cause that credential to be transmitted to an attacker-controlled server. |
Ansible Automation Platform
|
| CVE-2026-84720 | Sep 23, 2026 |
Ansible Automation Platform: WorkflowJobNode DB Leak via Unfiltered ancestor_artifactsA flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which stores the raw merged set_stats artifacts propagated between workflow nodes, is not wrapped in prevent_search() and is therefore accepted for arbitrary field lookups by the REST filter backend, even though it is omitted from the API serializer. Because the column is persisted before Ansible's no_log masking is applied, a user with only read access to a workflow or, via a regular-expression lookup that bypasses the JSON cross-relation filter guard through the world-readable credential-types endpoint, any authenticated user with no roles can use the result count as a boolean/count oracle to recover, character by character, secret values that a playbook author explicitly marked no_log, including across organizations. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-84718 | Sep 23, 2026 |
Ansible Automation Platform: X-Forwarded-For Header Trust (CVE-2026-84718)A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost (attacker-controlled) header value. As a result, an attacker can forge the source IP address recorded for their requests in the Controller's audit and access logs, degrading the integrity of forensic and SIEM attribution. The flaw does not grant additional access. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-84717 | Sep 23, 2026 |
Ansible Platform: Unauth Bitbucket DC Webhook HMAC Bypass ID EnumerationA flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target template, causing the endpoint to return HTTP 200 for a template that has a Bitbucket DC webhook configured and HTTP 403 otherwise. An unauthenticated remote attacker can use this response discrepancy as an oracle to enumerate which Job Template and Workflow Job Template IDs have Bitbucket DC webhooks configured, without knowing the secret webhook_key. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-84716 | Sep 23, 2026 |
Red Hat Automation Controller: TLS Impersonation via Case-Insensitive HostnameA flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the Common Name, DNS subject-alternative-name, and receptor node-id are taken verbatim from the caller-chosen instance hostname, with a hard-coded ten-year validity, a random serial, and no issuance log or revocation list. Because the hostname charset validator is case-insensitive while the uniqueness validator is case-sensitive, an administrator can register a case variant of an existing control node's hostname and obtain a mesh-CA-signed certificate that TLS peers, which match hostnames case-insensitively, accept as that control node. In managed/hosted deployments where the customer holds controller superuser but the platform operator runs the mesh this yields a long-lived, non-revocable mesh peer credential and, with an on-path position, TLS impersonation or interception of control/hybrid mesh nodes. It does not grant direct remote code execution, because receptor work submission is gated by a separate signing key not included in the bundle. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-84713 | Sep 23, 2026 |
Red Hat Automation Controller: Cleartext Recipient Secret Leak via NotificationA flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ configuration is protected from API filtering, its recipient value is copied in clear text into the unprotected Notification.recipients field on every send. Because the credential-types endpoint is listable by any authenticated user and the API filter backend traverses object relations without per-hop authorization, a user with no privileges can use a relational filter as a boolean count-oracle to recover, character by character and across organizations, the secret recipient values of other tenants' notifications including PagerDuty service keys and Slack/Mattermost/RocketChat/Webhook bearer-token URLs. This flaw affects confidentiality. |
Ansible Automation Platform
|
| CVE-2026-84712 | Sep 23, 2026 |
Red Hat Automation Controller: /api/v2/ping over-serializes inventoryA flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory (node hostnames, node types, UUIDs, heartbeats, capacities, and exact versions), all instance-group names and membership, the deployment install UUID, and the active control node. A remote, unauthenticated attacker can use this to map the control plane and fingerprint software versions for targeted attacks. This flaw affects confidentiality only; it does not expose secrets, credentials, or tenant data. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-96889 | Sep 23, 2026 |
Use-After-Free in librsvg via nested XInclude duplicate entitiesA flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code. |
Enterprise Linux (RHEL)
|
| CVE-2026-85475 | Sep 23, 2026 |
Ansible Platform rsyslog RainerScript Injection Remote Code ExecutionA flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-controlled settings LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH and LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE into an rsyslog RainerScript config file without neutralizing RainerScript syntax. A privileged (superuser) user can inject rsyslog directives, including an omprog action, causing arbitrary command execution inside the control-plane rsyslog component. This allows disclosure of the controller SECRET_KEY and database credentials, decryption of all stored credentials, and full compromise of the control plane. |
Ansible Automation Platform
|
| CVE-2026-84719 | Sep 23, 2026 |
Ansible: Workflow Copy Bypass InstanceGroup Auth (CVE-2026-84719)A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of each cloned node and fails to check the instance_groups (and execution_environment and labels) that were preserved from the original. A user with organization workflow-admin permission but no role on the referenced instance groups can copy a workflow, become its administrator, and launch jobs pinned to instance groups they are not authorized to use including the control-plane instance group bypassing the InstanceGroup use_role boundary and causing attacker-influenced automation to run in the control-plane execution context. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-84714 | Sep 23, 2026 |
Ansible Automation Platform Jinja Injection via sanitize_jinja()A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular expressions to reject user-supplied Jinja, but the patterns stop at the first interior '}' or '%' character, so a Jinja expression containing an inner brace (for example an empty dict) is accepted while remaining valid Jinja. Because sanitize_jinja() is the sole guard on several launch-time fields ad-hoc command module_args, Machine-credential username / become_method / become_user, and inventory host names a low-privileged user can inject Jinja that ansible-core evaluates in the execution environment. This enables execution of arbitrary commands in the execution environment (bypassing an administrator's AD_HOC_COMMANDS module allowlist) and disclosure of secrets belonging to credentials the attacker cannot read (by templating a co-attached credential's injected environment variables), across the credential access-control boundary. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-84706 | Sep 23, 2026 |
Ansible Automation Platform Credential Variable Injection Container RCEA flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names against a deny-list (an ANSIBLE_* prefix check plus a fixed ENV_BLOCKLIST) that omits process-hijacking loader variables such as BASH_ENV, ENV, LD_PRELOAD, LD_LIBRARY_PATH, PYTHONSTARTUP and GIT_SSH_COMMAND. Combined with the credential file injector, a privileged user can write an attacker-controlled script into the execution environment and point BASH_ENV at it, obtaining arbitrary code execution inside the execution-environment container for any job that attaches a credential of that type. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-75884 | Sep 23, 2026 |
AWX Pod Spec Override Priv Esc via InitContainer InjectionA flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can exploit this to escalate privileges to OpenShift namespace-level access and exfiltrate namespace secrets. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-84691 | Sep 23, 2026 |
CVE-2026-84691: Ansible Automation Platform fmt-string leak exposes secretsA flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors is an administrator-controlled Python format-string template that is rendered with a live user object as an argument. Because Python string formatting permits attribute and item traversal on its arguments, an administrator can craft a template that walks from the user object into the application settings and reads the Django secret key and the database password. The formatted message is written to a logger that can be forwarded to an external log aggregator, whose destination is also administrator-controlled, allowing the secrets to be sent off the host. An authenticated administrator can thereby obtain the master encryption key used to protect all stored credentials and the database service password, enabling offline decryption of every stored credential, forgery of user sessions, and direct access to the controller database. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-84683 | Sep 23, 2026 |
Red Hat Ansible Automation Platform XSS via Unescaped ANSI HyperlinksA flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8 hyperlink sequence in the output is expanded into an HTML anchor whose href is not scheme- filtered or escaped, so a low-privileged user who can produce output -- or an external party whose data a playbook echoes -- can embed a javascript: link that is rendered into a text/html response with no Content-Security-Policy. When a higher-privileged user views the output page and clicks the link, attacker- controlled JavaScript executes in their authenticated session, allowing actions as that user up to full platform takeover. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-84499 | Sep 23, 2026 |
Red Hat Ansible Automation Platform: Password Disclosure via Survey RevalidationA flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification, the controller decrypts the stored password and includes its plaintext value in the minimum/maximum length validation error message returned in the HTTP response. A user with the delegated JobTemplate Admin role can tighten the survey length constraint and trigger revalidation of a schedule or node created by another, higher-privileged user, thereby recovering that user's stored password in plaintext. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-84502 | Sep 23, 2026 |
CVE-2026-84502: Ansible Automation Platform RCE via Unvalidated scm_urlA flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not validated against values that begin with a dash and is stored and passed verbatim to the git SCM module. Because the module runs git ls-remote with the URL as a positional argument and without a "--" separator, a git project URL such as "--upload-pack=<command>:x" is interpreted by git as the --upload-pack option and executed via a shell. A user with permission to create or modify a project in a single organization can thereby execute arbitrary commands on the control-plane task pod, with output reflected through the project update stdout endpoint, leading to cross-tenant compromise and in-cluster lateral movement |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-84474 | Sep 23, 2026 |
Red Hat AAP Automation-Controller CVE-2026-84474: Provisioning secret exposed via X-Forwarded-For, RA flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret (host_config_key) is exposed to users holding only the read-level view_jobtemplate permission -- both in the job template API representation and in the activity stream -- and the provisioning callback endpoint trusts a client-supplied X-Forwarded-For header to determine the calling host when the controller is deployed behind the AAP gateway with an empty proxy allow-list. By reading the secret and spoofing X-Forwarded-For to match any host in the job template's inventory, a minimally privileged or unauthenticated remote attacker can launch the job template against arbitrary managed hosts using the job template's credentials, resulting in privilege escalation and remote code execution on managed hosts. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-84486 | Sep 23, 2026 |
Red Hat Ansible: Unauth Debug Endpoints Grant Scheduler Lock AbuseA flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views that trigger the internal task, dependency, and workflow schedulers are configured to allow any user (including unauthenticated clients) and are routed in production builds because their URL include is not gated on the debug setting. An unauthenticated remote attacker can repeatedly invoke these endpoints to acquire the cluster-wide scheduler advisory lock; because the legitimate scheduler acquires the same lock without waiting, the attacker causes real scheduler runs to be skipped, stalling job dispatch for all tenants, while also consuming controller web workers. The debug root view additionally discloses the list of debug endpoints to unauthenticated callers. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-96546 | Sep 23, 2026 |
GIMP DDS Plugin Heap OutofBounds ReadA one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This may cause the plug-in to crash if the byte immediately following the pixel buffer is inaccessible; no information disclosure or code execution has been demonstrated. |
Enterprise Linux (RHEL)
|
| CVE-2026-71465 | Sep 23, 2026 |
Ansible-Core RunAdHocCommand Improper Arg Handling Enables CLI Opt InjectionRunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags (--version, --help) since injected element displaces required pattern positional. Would escalate if ansible-core ever defaults pattern. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-71464 | Sep 23, 2026 |
LaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash checkLaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash check, unlike Project/JobTemplate/JobLaunch serializers. Schedule and WFJT Node accept --upload-pack=/bin/id as scm_branch. Currently blocked at runtime by jobs.py:1502 ValueError check (defense-in-depth), but the API validation gap means sole reliance on a task-layer guard. Refactoring that guard away would promote this to RCE. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-71463 | Sep 23, 2026 |
Notification template Jinja AST whitelist only inspects static Getattr nodesNotification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts (job['job'+'_env']) and {% if job.id > 100 %} conditional gating bypass both the AST check and the test-render (stub has small job.id). At runtime, the gated branch executes and exceptions write full tracebacks into notification body, which is POSTed to attacker-controlled webhook URL. Leaks install paths, Python version, source line numbers. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-96545 | Sep 23, 2026 |
An out-of-bounds heap read flaw was found in GIMP's TIM image loaderAn out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in. |
Enterprise Linux (RHEL)
|
| CVE-2026-71462 | Sep 23, 2026 |
StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied pathsStringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRET_KEY, k8s service-account token, receptor sockets, ConfigMap mount points. Mainly impactful on managed AAP (ansiblecloud.com) where tenant admin != host admin. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-71461 | Sep 23, 2026 |
HostList.list() catches bare Exception and returns str(e) verbatimHostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers Django FieldError (leaking complete Host model relation graph including internal reverse accessors) or PostgreSQL DataError (leaking raw database error strings). Two primitives: credential__search=x dumps ORM schema, name__regex=[bad reflects PostgreSQL errors. |
Ansible Automation Platform
|
| CVE-2026-71460 | Sep 23, 2026 |
/api/v2/config/ is protected only by IsAuthenticated/api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_id, sku, support_level, instance counts) returned to any authenticated user. The superuser/auditor gate only covers project_base_dir/project_local_paths/custom_virtualenvs, not license_info. Enables social engineering against Red Hat support and estate sizing reconnaissance. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-76648 | Sep 23, 2026 |
CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBACCopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC. The get() handler (lines 988991) explicitly guards with request.user.can_access(obj._class_, 'read', obj) but post() (lines 10011010) does not. POST only checks: can_access(model, 'add', create_kwargs_check) can_access(model, 'copy_related', obj) For JobTemplate, can_add (awx/awx/main/access.py:14651520) gates on inventory.use_role + project.use_role + execution_environment.read_role resource-level roles that do not imply read on the source JT and can_copy_related (15221534) checks only credentials.use_role. None of these imply the caller can read the source JT. |
Ansible Automation Platform
|
| CVE-2026-96541 | Sep 23, 2026 |
A denial-of-service flaw was found in gnome-remote-desktopA denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is closed. |
Enterprise Linux (RHEL)
|
| CVE-2026-71459 | Sep 23, 2026 |
JobJobEventsChildrenSummary view has no model/parent_modelJobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through (returns True) for any authenticated user. The view uses raw get_object_or_404(Job, pk) without DRF object-level permission check. Zero-privilege user reads event tree structure, event_processing_finished status, and enumerates Job IDs platform-wide via 200/404 oracle. Sibling endpoint /jobs/{id}/job_events/ correctly returns 403. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-71458 | Sep 23, 2026 |
URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBACURLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. Differential "Not found." vs "No <Model> matches..." reveals whether a named resource (org, credential, inventory, host) exists anywhere on the platform. Enables cross-tenant internal hostname enumeration. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-88840 | Sep 23, 2026 |
BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message. |
Hummingbird
|
| CVE-2026-88839 | Sep 23, 2026 |
BusyBox passwd/group tokenize() references a stale endpoint pointer after trimmingBusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers. |
Hummingbird
|
| CVE-2026-88837 | Sep 23, 2026 |
BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic AuthenticationBusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check. |
Hummingbird
|
| CVE-2026-88835 | Sep 23, 2026 |
BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packagesBusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read. |
Hummingbird
|
| CVE-2026-88831 | Sep 23, 2026 |
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail openBusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients. |
Hummingbird
|
| CVE-2026-88832 | Sep 23, 2026 |
BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadataBusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images. |
Hummingbird
|
| CVE-2026-88830 | Sep 23, 2026 |
A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message.A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message. |
Hummingbird
|