Red Hat Security Advisory

RHSA-2026:1596

Red Hat Ansible Automation Platform 2.6 Container Release Update

Released 2026-01-29 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9 +7

TI-2025-39861 CVE-2025-64459 · GHSA-frmv-pr5f-9mcr

HIGH 65

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.19257 Published 2025-11-05 Partial fix · 5.2.8, 5.1.14 +1 CWE-89

TI-2026-17326 CVE-2026-21441 · GHSA-38jv-5279-wg99

MEDIUM 50

urllib3 is an HTTP client library for Python.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.02922 Published 2026-01-07 Partial fix · 2.6.3 CWE-409

TI-2025-40557 CVE-2025-66031 · GHSA-554w-wpv2-vw27

MEDIUM 44

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00446 Published 2025-11-26 Partial fix · 1.3.2 CWE-674

TI-2025-42677 CVE-2025-69223 · GHSA-6mq8-rvhq-8wgg

MEDIUM 40

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00583 Published 2026-01-05 Partial fix · 3.13.3 CWE-409

TI-2025-40898 CVE-2025-66471 · GHSA-2xpw-w6gg-jr37

MEDIUM 40

urllib3 is a user-friendly HTTP client library for Python.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00731 Published 2025-12-05 Partial fix · 2.6.0 CWE-409

TI-2025-40852 CVE-2025-66416 · GHSA-9h52-p55h-vw2f

LOW 36

The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP).

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00544 Published 2025-12-02 Partial fix · 1.23.0 CWE-1188

TI-2025-13959 CVE-2025-15284 · GHSA-6rw7-vpxm-498p

LOW 34

Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0045 Published 2025-12-29 Partial fix · 6.14.1 CWE-20

TI-2025-38896 CVE-2025-62706 · GHSA-g7f3-828f-7h7m

LOW 29

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00458 Published 2025-10-22 Partial fix · 1.6.5 CWE-400