Red Hat Ansible Automation Platform 2.6
41 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Red Hat Ansible Automation Platform 2.6, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.
Red Hat Ansible Automation Platform 2.6 CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 1 |
| 2026-02 | 4 |
| 2026-03 | 0 |
| 2026-04 | 1 |
| 2026-05 | 1 |
| 2026-06 | 3 |
| 2026-07 | 3 |
| 2026-08 | 4 |
| 2026-09 | 24 |
Severity
How the 41 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical7
- High14
- Medium17
- Low3
Latest CVEs
The 15 most recently published vulnerabilities affecting Red Hat Ansible Automation Platform 2.6.
- CVE-2026-84724Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process6.6
- CVE-2026-84720Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracle6.5
- CVE-2026-84718Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust4.3
- CVE-2026-84717Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templates5.3
- CVE-2026-84716Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnames6.6
- CVE-2026-84712Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership5.3
- CVE-2026-84719Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)9.9
- CVE-2026-84714Automation-controller: automation-controller: incomplete sanitize_jinja() regex allows jinja template injection into ad-hoc module_args, machine-credential fields, and host names, reaching ansible-core templating in the execution environment7.1
- CVE-2026-84706Automation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijacking variables (bash_env/ld_preload) allowing code execution in the execution environment7.6
- CVE-2026-75884Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups9.1
- CVE-2026-84691Automation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting discloses django secret_key and database credentials to an administrator8.7
- CVE-2026-84683Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink sequences (javascript: anchor) enabling session takeover8.7
- CVE-2026-84499Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplatenode survey min/max validation error message7.7
- CVE-2026-84502Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane pod9.9
- CVE-2026-84474Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioning-callback host match9.9
Product grouping is registry-driven, with AI assist and human review. How it works