Loading story…
Red Hat released Important security updates for Ansible Automation Platform (AAP) 2.4 and 2.5 and its Execution Environments, remediating Jinja2 sandbox-breakout flaws CVE-2024-56201 and CVE-2024-56326, plus aiohttp request smuggling vulnerability CVE-2024-52304. The Jinja issues can be triggered through malicious filenames or indirect references to the format method, while the aiohttp flaw affects the pure-Python HTTP parser's handling of newlines in chunk extensions and may permit proxy or firewall bypasses when C extensions are unavailable or disabled.
The advisories also address Django denial-of-service issues CVE-2024-53907 and CVE-2024-56374, Django Oracle SQL injection CVE-2024-53908, and a gRPC-C++ denial-of-service condition in affected container releases. Organizations running AAP on RHEL 8 or 9—including ansible-lightspeed-container, Automation Controller, and ee-minimal-container images—should apply the updated packages and container images; updates include Automation Controller 4.5.17 or 4.6.7, Jinja2 3.1.5, Django 4.2.18, and aiohttp fixes.
See real exploitation activity before you spend the cycle.
9 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important advisory RHSA-2025:1101 for Ansible Automation Platform Execution Environments, addressing aiohttp request smuggling and two Jinja sandbox-breakout vulnerabilities in ee-minimal-container. Updated ansible-builder and ee-minimal images were published for RHEL 8 and 9.
Red Hat issued Important advisory RHSA-2025:0753 for Ansible Automation Platform Execution Environments, fixing aiohttp request smuggling and two Jinja sandbox-breakout flaws in ee-minimal-container. Updated ansible-builder and ee-minimal images were supplied for RHEL 8 and 9 supported architectures.
Red Hat issued Important advisory RHSA-2025:0341 for Ansible Automation Platform 2.5 container releases, addressing Jinja sandbox-breakout flaws, aiohttp request smuggling, and a gRPC-C++ denial-of-service issue. The update also updated the ansible.controller collection to version 4.6.6.
Red Hat released Important advisory RHSA-2025:0777 for Ansible Automation Platform 2.5, remediating Jinja sandbox-breakout and Django denial-of-service vulnerabilities. The update included automation-controller 4.6.7, python3.11-jinja2 3.1.5, and python3.11-django 4.2.18.
Red Hat issued Important advisory RHSA-2025:0722 for Ansible Automation Platform 2.4 container releases, addressing gRPC-C++, Django, Jinja2, and aiohttp vulnerabilities. The release updated Automation Controller and ansible.controller to version 4.5.17 and Ansible Lightspeed to 2.4.20250121.
Red Hat released Important advisory RHSA-2025:0721 for Ansible Automation Platform 2.4, fixing two Jinja sandbox-breakout vulnerabilities and Django Oracle SQL-injection flaw CVE-2024-53908. Automation Controller was updated to 4.5.17 and Jinja2 packages to 3.1.5.
Red Hat addressed CVE-2024-52304 in Ansible Automation Platform 2.5 for RHEL 8 and 9 through RHSA-2025:0340.
Red Hat addressed CVE-2024-52304 for Red Hat Satellite 6.16 on RHEL 8 and 9 through RHSA-2024:11574.
Red Hat addressed CVE-2024-52304, an aiohttp request-smuggling vulnerability, for Ansible Automation Platform 2.5 on RHEL 8 and 9 through RHSA-2024:10766.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
8 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for **Red Hat Ansible Automation Platform** versions **2.5, 2.6, and 2.7**, remediating a broad set of vulnerabilities across `automation-controller`, `automation-gateway`, `automation-platform-ui`, `automation-controller-cli`, and bundled dependencies. The advisories cover issues including **remote code execution**, **path traversal**, **server-side request forgery with credential leakage**, **command injection**, **HTTP request smuggling**, **arbitrary file overwrite/read**, **environment variable exfiltration**, and **denial of service**. Affected offerings also include **Red Hat Ansible Inside** and **Red Hat Ansible Developer** on RHEL 8, 9, and 10 across multiple architectures. The updates include fixes for specific third-party flaws such as **`CVE-2026-34993`** in `aiohttp` that could lead to arbitrary code execution through untrusted input to `CookieJar.load()`, **`CVE-2026-59886`** in `pyasn1` that can trigger CPU and memory exhaustion via crafted ASN.1 REAL values, and **`CVE-2026-39373`** in `JWCrypto` that enables memory exhaustion through compressed JWE tokens. Red Hat also addressed **`CVE-2026-44705`** in the Node.js `tmp` package for RHEL 10 and, in Ansible Automation Platform 2.7, patched **`CVE-2026-52902`** in `automation-controller-cli` and **`CVE-2026-15307`** in Django. Updated package versions include `automation-controller` 4.6.32 and 4.7.16, `automation-controller-cli` 4.8.6, `python3.12-aiohttp` 3.14.3, `python3.12-django` 5.2.17, `python3.12-gitpython` 3.1.59, and `python3.12-jwcrypto` 1.5.8.
Aug 25, 2026
Red Hat released **Important** security updates for **Red Hat Ansible Automation Platform 2.5 and 2.6**, addressing a broad set of vulnerabilities across `ansible-core`, `automation-controller`, `automation-gateway`, `automation-platform-ui`, `pulpcore`, `urllib3`, `pip`, `receptor`, and multiple Go libraries. The advisories, **RHSA-2026:42078** and **RHSA-2026:42079**, cover issues ranging from arbitrary code execution and privilege escalation to denial of service, information disclosure, MITM and proxy-bypass conditions. Notable flaws include `CVE-2026-8643`, a `pip` wheel-installation path traversal bug that can overwrite files outside the intended directory; `CVE-2026-12701`, a `pulpcore` path traversal vulnerability that can let an authenticated administrator write files outside the export directory; and `CVE-2026-44432`, a `urllib3` decompression flaw that can drive excessive CPU and memory consumption. Red Hat also tied the updates to multiple **Go HTML parsing and certificate-handling vulnerabilities** affecting products in the platform stack. `CVE-2026-25681` and `CVE-2026-27136` in `golang.org/x/net/html` can let crafted HTML bypass sanitization and trigger **cross-site scripting**, with potential downstream code-execution impact in some application contexts, while `CVE-2026-27145` in Go's `crypto/x509` can cause quadratic CPU consumption during TLS hostname verification with a malicious certificate. Red Hat said fixes were issued across affected Ansible Automation Platform builds and related product variants, including Ansible Inside and Ansible Developer, and advised customers to apply the updated packages and follow platform release documentation for upgrade steps.
Aug 28, 2026
Red Hat released an **Important** security update for **Red Hat Ansible Automation Platform 2.4** to fix `CVE-2025-61726`, a memory exhaustion flaw in Go's `net/url` query-parameter parsing that affects the platform's **Receptor** component. The advisory applies across multiple Ansible Automation Platform, Ansible Inside, and Ansible Developer builds for **RHEL 8** and **RHEL 9** on `x86_64`, `s390x`, `ppc64le`, and `aarch64`, and requires customers to use the latest installer because older installers may fail during installation or upgrade. Red Hat's 2.4 asynchronous release notes place the Receptor fix within a broader stream of security and stability updates spanning Automation controller, Automation hub, Event-Driven Ansible, the AAP Operator, and Red Hat Ansible Lightspeed. Those updates address additional risks including denial-of-service, SQL injection, XSS, request smuggling, sandbox breakout, arbitrary code execution, and information exposure, while also documenting platform changes such as a refresh to **Python 3.12**, PostgreSQL 15 adoption, newer OpenShift support, and fixes for inventory sync performance, long-running query failures, rendering crashes, and backup and restore issues.
Aug 20, 2026