Red Hat Security Advisory

RHSA-2026:3960

Red Hat Ansible Automation Platform 2.6 Container Release Update

Released 2026-03-06 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-minimal-rhel9 +9

Fixes 17 records

TI-2026-19377 CVE-2026-24049 · GHSA-8rrh-rw8j-w5fx

wheel Allows Arbitrary File Permission Modification via Path Traversal

MEDIUM 64

wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427.

CVSS 3.1HIGH 7.1 Local No auth User interaction EPSS 0.0035 Published 2026-01-22 Partial fix · 0.46.2 CWE-22

TI-2026-17326 CVE-2026-21441 · GHSA-38jv-5279-wg99

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

MEDIUM 50

urllib3 is an HTTP client library for Python.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.02922 Published 2026-01-07 Partial fix · 2.6.3 CWE-409

TI-2025-37931 CVE-2025-61140 · GHSA-6c59-mwgh-r2x6

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.

MEDIUM 49

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00526 Published 2026-01-28 Partial fix · 1.2.0 CWE-1321

TI-2025-38128 CVE-2025-61726 · GHSA-gm9r-q53w-2gh4

Memory exhaustion in query parameter parsing in net/url

MEDIUM 43

The net/url package does not set a limit on the number of query parameters in a query.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02292 Published 2026-01-28 Partial fix · 1.24.12, 1.25.6 CWE-770

TI-2026-19738 CVE-2026-24486 · GHSA-wp53-j4wj-2cfg

Python-Multipart has Arbitrary File Write via Non-Default Configuration

MEDIUM 42

Python-Multipart is a streaming multipart parser for Python.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.02206 Published 2026-01-27 Partial fix · 0.0.22 CWE-22

TI-2025-04079 CVE-2025-4565 · GHSA-8qvm-5x2c-j2w7

Unbounded recursion in Python Protobuf

MEDIUM 41

Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding…

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00255 Published 2025-06-16 Partial fix · 4.25.8, 5.29.5 +1 CWE-674

TI-2025-42677 CVE-2025-69223 · GHSA-6mq8-rvhq-8wgg

AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

MEDIUM 40

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00583 Published 2026-01-05 Partial fix · 3.13.3 CWE-409

TI-2025-40898 CVE-2025-66471 · GHSA-2xpw-w6gg-jr37

urllib3 Streaming API improperly handles highly compressed data

MEDIUM 40

urllib3 is a user-friendly HTTP client library for Python.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00731 Published 2025-12-05 Partial fix · 2.6.0 CWE-409

TI-2025-12309 CVE-2025-13465 · GHSA-xxjr-mmjv-4gpg

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

MEDIUM 40

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.01823 Published 2026-01-21 Partial fix · 4.17.23, 4.18.0 CWE-1321

TI-2026-00932 CVE-2026-1207 · GHSA-mwm9-4648-f68q

Potential SQL injection via raster lookups on PostGIS

LOW 39

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.12819 Published 2026-02-03 Partial fix · 6.0.2, 5.2.11 +1 CWE-89

TI-2026-17723 CVE-2026-22029 · GHSA-2w69-qvjg-hvjx

React Router vulnerable to XSS via Open Redirects

LOW 38

React Router is a router for React.

CVSS 3.1HIGH 8.0 Network No auth User interaction EPSS 0.00866 Published 2026-01-10 Partial fix · 7.12.0, 1.23.2 CWE-79

TI-2026-17585 CVE-2026-21884 · GHSA-8v8x-cx79-35w7

React Router SSR XSS in ScrollRestoration

LOW 38

React Router is a router for React.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00531 Published 2026-01-10 Fixed in 7.12.0, 2.17.3 CWE-79

TI-2025-36699 CVE-2025-59057 · GHSA-3cgp-3xvw-98x8

React Router has XSS Vulnerability

LOW 34

React Router is a router for React.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00503 Published 2026-01-10 Fixed in 7.9.0, 2.17.1 CWE-79

TI-2026-20645 CVE-2026-25536 · GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

LOW 31

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00293 Published 2026-02-04 Fixed in 1.26.0 CWE-362

TI-2026-01025 CVE-2026-1312 · GHSA-6426-9fv3-65x8

Potential SQL injection via QuerySet.order_by and FilteredRelation

LOW 26

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00897 Published 2026-02-03 Partial fix · 6.0.2, 5.2.11 +1 CWE-89

TI-2026-01003 CVE-2026-1287 · GHSA-gvg8-93h5-g6qq

Potential SQL injection in column aliases via control characters

LOW 26

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00843 Published 2026-02-03 Partial fix · 6.0.2, 5.2.11 +1 CWE-89

TI-2025-33569 CVE-2025-53643 · GHSA-9548-qrrj-x5pj

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

LOW 10

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0LOW 1.7 Network No auth No interaction EPSS 0.00355 Published 2025-07-14 Partial fix · 3.12.14 CWE-444