Loading story…
dCERT issued advisories for Red Hat Ansible Automation Platform and its self-service automation portal, warning of multiple vulnerabilities affecting the enterprise automation stack. One advisory identifies a flaw in the self-service automation portal that can allow manipulation of files, raising the risk of unauthorized changes to data or application content within affected deployments.
A separate dCERT advisory reports multiple vulnerabilities in Red Hat Ansible Automation Platform, indicating broader security exposure beyond the portal component alone. Organizations using the platform should review the affected products and versions in the vendor guidance, assess exposure across both the core platform and portal deployments, and prioritize remediation to reduce the risk of compromise or misuse of automation infrastructure.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
dCERT published Advisory 2026-0915 describing multiple vulnerabilities affecting Red Hat Ansible Automation Platform.
dCERT published Advisory 2026-0321 covering a vulnerability in the Red Hat Self-service automation portal for Red Hat Ansible Automation Platform that allows manipulation of files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
dcert.de
Open sourcedcert.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for **Red Hat Ansible Automation Platform** versions **2.5, 2.6, and 2.7**, remediating a broad set of vulnerabilities across `automation-controller`, `automation-gateway`, `automation-platform-ui`, `automation-controller-cli`, and bundled dependencies. The advisories cover issues including **remote code execution**, **path traversal**, **server-side request forgery with credential leakage**, **command injection**, **HTTP request smuggling**, **arbitrary file overwrite/read**, **environment variable exfiltration**, and **denial of service**. Affected offerings also include **Red Hat Ansible Inside** and **Red Hat Ansible Developer** on RHEL 8, 9, and 10 across multiple architectures. The updates include fixes for specific third-party flaws such as **`CVE-2026-34993`** in `aiohttp` that could lead to arbitrary code execution through untrusted input to `CookieJar.load()`, **`CVE-2026-59886`** in `pyasn1` that can trigger CPU and memory exhaustion via crafted ASN.1 REAL values, and **`CVE-2026-39373`** in `JWCrypto` that enables memory exhaustion through compressed JWE tokens. Red Hat also addressed **`CVE-2026-44705`** in the Node.js `tmp` package for RHEL 10 and, in Ansible Automation Platform 2.7, patched **`CVE-2026-52902`** in `automation-controller-cli` and **`CVE-2026-15307`** in Django. Updated package versions include `automation-controller` 4.6.32 and 4.7.16, `automation-controller-cli` 4.8.6, `python3.12-aiohttp` 3.14.3, `python3.12-django` 5.2.17, `python3.12-gitpython` 3.1.59, and `python3.12-jwcrypto` 1.5.8.
Aug 25, 2026
Red Hat released **Important** security updates for **Red Hat Ansible Automation Platform 2.5 and 2.6**, addressing a broad set of vulnerabilities across `ansible-core`, `automation-controller`, `automation-gateway`, `automation-platform-ui`, `pulpcore`, `urllib3`, `pip`, `receptor`, and multiple Go libraries. The advisories, **RHSA-2026:42078** and **RHSA-2026:42079**, cover issues ranging from arbitrary code execution and privilege escalation to denial of service, information disclosure, MITM and proxy-bypass conditions. Notable flaws include `CVE-2026-8643`, a `pip` wheel-installation path traversal bug that can overwrite files outside the intended directory; `CVE-2026-12701`, a `pulpcore` path traversal vulnerability that can let an authenticated administrator write files outside the export directory; and `CVE-2026-44432`, a `urllib3` decompression flaw that can drive excessive CPU and memory consumption. Red Hat also tied the updates to multiple **Go HTML parsing and certificate-handling vulnerabilities** affecting products in the platform stack. `CVE-2026-25681` and `CVE-2026-27136` in `golang.org/x/net/html` can let crafted HTML bypass sanitization and trigger **cross-site scripting**, with potential downstream code-execution impact in some application contexts, while `CVE-2026-27145` in Go's `crypto/x509` can cause quadratic CPU consumption during TLS hostname verification with a malicious certificate. Red Hat said fixes were issued across affected Ansible Automation Platform builds and related product variants, including Ansible Inside and Ansible Developer, and advised customers to apply the updated packages and follow platform release documentation for upgrade steps.
Aug 28, 2026
Red Hat released **Important** security updates for Ansible Automation Platform (AAP) 2.4 and 2.5 and its Execution Environments, remediating Jinja2 sandbox-breakout flaws `CVE-2024-56201` and `CVE-2024-56326`, plus aiohttp request smuggling vulnerability `CVE-2024-52304`. The Jinja issues can be triggered through malicious filenames or indirect references to the `format` method, while the aiohttp flaw affects the pure-Python HTTP parser's handling of newlines in chunk extensions and may permit proxy or firewall bypasses when C extensions are unavailable or disabled. The advisories also address Django denial-of-service issues `CVE-2024-53907` and `CVE-2024-56374`, Django Oracle SQL injection `CVE-2024-53908`, and a gRPC-C++ denial-of-service condition in affected container releases. Organizations running AAP on RHEL 8 or 9—including `ansible-lightspeed-container`, Automation Controller, and `ee-minimal-container` images—should apply the updated packages and container images; updates include Automation Controller 4.5.17 or 4.6.7, Jinja2 3.1.5, Django 4.2.18, and aiohttp fixes.
Aug 27, 2026