Loading story…
Red Hat released an Important security update for Red Hat Ansible Automation Platform 2.4 to fix CVE-2025-61726, a memory exhaustion flaw in Go's net/url query-parameter parsing that affects the platform's Receptor component. The advisory applies across multiple Ansible Automation Platform, Ansible Inside, and Ansible Developer builds for RHEL 8 and RHEL 9 on x86_64, s390x, ppc64le, and aarch64, and requires customers to use the latest installer because older installers may fail during installation or upgrade.
Red Hat's 2.4 asynchronous release notes place the Receptor fix within a broader stream of security and stability updates spanning Automation controller, Automation hub, Event-Driven Ansible, the AAP Operator, and Red Hat Ansible Lightspeed. Those updates address additional risks including denial-of-service, SQL injection, XSS, request smuggling, sandbox breakout, arbitrary code execution, and information exposure, while also documenting platform changes such as a refresh to Python 3.12, PostgreSQL 15 adoption, newer OpenShift support, and fixes for inventory sync performance, long-running query failures, rendering crashes, and backup and restore issues.
See real exploitation activity before you spend the cycle.
17 events from the most recent confirmed update back to the earliest known activity.
On August 4, 2026, Red Hat released Ansible Automation Platform 2.4 updates including Automation controller 4.5.35, Automation hub 4.9.8, Event-Driven Ansible 1.0.11, and Receptor 1.6.4. The release fixed an Automation hub UI crash caused by large API response fields and resolved job and workflow failures after long-running queries.
On July 15, 2026, Red Hat released an Ansible Automation Platform 2.4 update that fixed excessive inventory synchronization time when processing a large number of changes.
On May 4, 2026, Red Hat released Ansible Automation Platform 2.4 security and bug-fix updates across multiple components. The release added PQC signature support for execution environments in Automation hub and fixed an upgrade failure during Automation hub database migrations from older pulp_ansible versions.
On March 26, 2026, Red Hat released an Ansible Automation Platform 2.4 update that upgraded the platform to Python 3.12 and required a new installer for both containerized and RPM deployments. The release also noted that Django 5.2 requires PostgreSQL 14 or higher because PostgreSQL 13 support was dropped.
On February 25, 2026, Red Hat released an Ansible Automation Platform 2.4 update addressing CVE-2025-61726, a memory exhaustion vulnerability in Go net/url query parameter parsing affecting Receptor.
On January 28, 2026, Red Hat released an Ansible Automation Platform 2.4 update addressing CVE-2025-66471 in urllib3, CVE-2025-69223 in AIOHTTP, CVE-2025-64460 in Django XML deserialization, and CVE-2025-61729 in Receptor.
On January 6, 2026, Red Hat released an Ansible Automation Platform 2.4 update addressing CVE-2025-68664 in Red Hat Ansible Lightspeed, described as arbitrary code execution via LangChain serialization injection.
On December 10, 2025, Red Hat released an Ansible Automation Platform 2.4 update addressing CVE-2025-64459, a Django SQL injection issue in Red Hat Ansible Lightspeed.
On November 19, 2025, Red Hat updated Ansible Automation Platform 2.4 to require minimum supported RHEL versions 8.10 and 9.4. The same release updated nginx to 1.24, moved the platform from Python 3.9 to Python 3.11, and fixed CVE-2025-59530 in Receptor.
On September 22, 2025, Red Hat released an Ansible Automation Platform 2.4 update addressing CVE-2025-57833, a Django SQL injection issue involving FilteredRelation column aliases.
On July 2, 2025, Red Hat released an Ansible Automation Platform 2.4 update addressing CVE-2025-2287 in Receptor, described as request smuggling due to acceptance of invalid chunked data in Go net/http. The release also adopted PostgreSQL 15 for fresh installs and added upgrade logic for managed database deployments.
On June 9, 2025, Red Hat released an Ansible Automation Platform 2.4 update addressing CVE-2025-26699, a potential denial-of-service issue in django.utils.text.wrap(). The same release also fixed unauthenticated execution environment pulls.
On April 9, 2025, Red Hat released an Ansible Automation Platform 2.4 update addressing CVE-2025-2877 in ansible-rulebook, which exposed inventory passwords in plain text when starting a rulebook activation with debug verbosity in Event-Driven Ansible.
On March 26, 2025, Red Hat released an Ansible Automation Platform 2.4 update addressing CVE-2025-27516, a Jinja sandbox breakout through the attr filter selecting the format method. The issue affected automation-controller, Jinja2 packages, and the ansible-lightspeed-container.
On January 29, 2025, Red Hat released an Ansible Automation Platform 2.4 update addressing CVE-2024-53908, a potential SQL injection issue in Django HasKey(lhs, rhs) on Oracle affecting automation-controller and Lightspeed.
On December 3, 2024, Red Hat released an Ansible Automation Platform 2.4 update that addressed CVE-2024-45801, an XSS vulnerability via prototype pollution in automation-controller.
On March 12, 2026, Red Hat issued Important security advisory RHSA-2026:4460 for Red Hat Ansible Automation Platform 2.4. The advisory provided an update for CVE-2025-61726 in Receptor and warned users to download the latest installer because older installers could fail during installation or upgrade.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
docs.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for **Red Hat Ansible Automation Platform 2.5 and 2.6**, addressing a broad set of vulnerabilities across `ansible-core`, `automation-controller`, `automation-gateway`, `automation-platform-ui`, `pulpcore`, `urllib3`, `pip`, `receptor`, and multiple Go libraries. The advisories, **RHSA-2026:42078** and **RHSA-2026:42079**, cover issues ranging from arbitrary code execution and privilege escalation to denial of service, information disclosure, MITM and proxy-bypass conditions. Notable flaws include `CVE-2026-8643`, a `pip` wheel-installation path traversal bug that can overwrite files outside the intended directory; `CVE-2026-12701`, a `pulpcore` path traversal vulnerability that can let an authenticated administrator write files outside the export directory; and `CVE-2026-44432`, a `urllib3` decompression flaw that can drive excessive CPU and memory consumption. Red Hat also tied the updates to multiple **Go HTML parsing and certificate-handling vulnerabilities** affecting products in the platform stack. `CVE-2026-25681` and `CVE-2026-27136` in `golang.org/x/net/html` can let crafted HTML bypass sanitization and trigger **cross-site scripting**, with potential downstream code-execution impact in some application contexts, while `CVE-2026-27145` in Go's `crypto/x509` can cause quadratic CPU consumption during TLS hostname verification with a malicious certificate. Red Hat said fixes were issued across affected Ansible Automation Platform builds and related product variants, including Ansible Inside and Ansible Developer, and advised customers to apply the updated packages and follow platform release documentation for upgrade steps.
Aug 28, 2026
Red Hat released **Important** security updates for **Red Hat Ansible Automation Platform** versions **2.5, 2.6, and 2.7**, remediating a broad set of vulnerabilities across `automation-controller`, `automation-gateway`, `automation-platform-ui`, `automation-controller-cli`, and bundled dependencies. The advisories cover issues including **remote code execution**, **path traversal**, **server-side request forgery with credential leakage**, **command injection**, **HTTP request smuggling**, **arbitrary file overwrite/read**, **environment variable exfiltration**, and **denial of service**. Affected offerings also include **Red Hat Ansible Inside** and **Red Hat Ansible Developer** on RHEL 8, 9, and 10 across multiple architectures. The updates include fixes for specific third-party flaws such as **`CVE-2026-34993`** in `aiohttp` that could lead to arbitrary code execution through untrusted input to `CookieJar.load()`, **`CVE-2026-59886`** in `pyasn1` that can trigger CPU and memory exhaustion via crafted ASN.1 REAL values, and **`CVE-2026-39373`** in `JWCrypto` that enables memory exhaustion through compressed JWE tokens. Red Hat also addressed **`CVE-2026-44705`** in the Node.js `tmp` package for RHEL 10 and, in Ansible Automation Platform 2.7, patched **`CVE-2026-52902`** in `automation-controller-cli` and **`CVE-2026-15307`** in Django. Updated package versions include `automation-controller` 4.6.32 and 4.7.16, `automation-controller-cli` 4.8.6, `python3.12-aiohttp` 3.14.3, `python3.12-django` 5.2.17, `python3.12-gitpython` 3.1.59, and `python3.12-jwcrypto` 1.5.8.
Aug 25, 2026
Red Hat released **Important** security updates for Ansible Automation Platform (AAP) 2.4 and 2.5 and its Execution Environments, remediating Jinja2 sandbox-breakout flaws `CVE-2024-56201` and `CVE-2024-56326`, plus aiohttp request smuggling vulnerability `CVE-2024-52304`. The Jinja issues can be triggered through malicious filenames or indirect references to the `format` method, while the aiohttp flaw affects the pure-Python HTTP parser's handling of newlines in chunk extensions and may permit proxy or firewall bypasses when C extensions are unavailable or disabled. The advisories also address Django denial-of-service issues `CVE-2024-53907` and `CVE-2024-56374`, Django Oracle SQL injection `CVE-2024-53908`, and a gRPC-C++ denial-of-service condition in affected container releases. Organizations running AAP on RHEL 8 or 9—including `ansible-lightspeed-container`, Automation Controller, and `ee-minimal-container` images—should apply the updated packages and container images; updates include Automation Controller 4.5.17 or 4.6.7, Jinja2 3.1.5, Django 4.2.18, and aiohttp fixes.
Aug 27, 2026