Red Hat Security Advisory

RHSA-2026:42078

Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Released 2026-07-20 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Ansible Automation Platform 2.5 for RHEL 8 ansible-core-1:2.16.19-1.el8ap, ansible-test-1:2.16.19-1.el8ap, automation-controller-4.6.30-2.el8ap +24
Red Hat Ansible Automation Platform 2.5 for RHEL 9 ansible-core-1:2.16.19-1.el9ap, ansible-test-1:2.16.19-1.el9ap, automation-controller-4.6.30-2.el9ap +24

Fixes 25 records

TI-2026-32427 CVE-2026-44492 · GHSA-pjwm-pj3p-43mv

Server-side request forgery in axios

HIGH 76

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.1228 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-918

TI-2026-30595 CVE-2026-42284 · GHSA-x2qx-6953-8485

GitPython: Unsafe option check validates multi_options before shlex.split transforms it

HIGH 76

GitPython is a python library used to interact with Git repositories.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00571 Published 2026-05-07 Partial fix · 3.1.47 CWE-88

TI-2026-32428 CVE-2026-44494 · GHSA-35jp-ww65-95wh

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

HIGH 73

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.01057 Published 2026-06-11 Partial fix · 1.16.0 CWE-1321

TI-2026-30536 CVE-2026-42215 · GHSA-rpm5-65cw-6hj4

GitPython: Command injection via Git options bypass

HIGH 73

GitPython is a python library used to interact with Git repositories.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00749 Published 2026-05-07 Partial fix · 3.1.47 CWE-78

TI-2026-32430 CVE-2026-44496 · GHSA-hfxv-24rg-xrqf

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05405 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-1333

TI-2026-32424 CVE-2026-44488 · GHSA-777c-7fjr-54vf

Axios: Allocation of Resources Without Limits or Throttling in axios

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00669 Published 2026-06-11 Partial fix · 1.16.0 CWE-770

TI-2026-32422 CVE-2026-44486 · GHSA-j5f8-grm9-p9fc

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00552 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-200

TI-2026-30423 CVE-2026-42044 · GHSA-3w6x-2g7m-8v23

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00618 Published 2026-04-24 Partial fix · 1.15.2 CWE-1321

TI-2026-32429 CVE-2026-44495 · GHSA-3g43-6gmg-66jw

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

HIGH 69

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.7 Network No auth No interaction EPSS 0.00854 Published 2026-06-11 Partial fix · 1.15.2, 0.31.1 CWE-1321

TI-2026-32423 CVE-2026-44487 · GHSA-p92q-9vqr-4j8v

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

HIGH 69

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00689 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-201

TI-2026-32221 CVE-2026-44244 · GHSA-v87r-6q3f-2j67

GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath

HIGH 69

GitPython is a python library used to interact with Git repositories.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00237 Published 2026-05-07 Partial fix · 3.1.49 CWE-94

TI-2026-04185 CVE-2026-4800 · GHSA-r5fr-rjxr-66jc

lodash vulnerable to Code Injection via `_.template` imports key names

MEDIUM 48

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02808 Published 2026-03-31 Partial fix · 4.18.1, 4.18.0 CWE-94

TI-2026-28703 CVE-2026-39821 · GHSA-w2q5-6q6x-x959

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

MEDIUM 47

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.01834 Published 2026-05-22 Partial fix · 1.25.13, 1.26.6 +2 CWE-1289

TI-2026-10631 CVE-2026-12382 · GHSA-45w6-c976-v24q

Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing

MEDIUM 42

A flaw was found in the AAP Gateway Envoy proxy configuration.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00464 Published 2026-07-15 Fixed in 2.5.20260715-1.el8ap, 2.5.20260715-1.el9ap +3 CWE-290

TI-2026-10860 CVE-2026-12701 · GHSA-j5cg-p988-g42q

Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport

MEDIUM 41

A path traversal vulnerability was found in pulpcore.

CVSS 3.1CRITICAL 9.0 Network High privileges No interaction EPSS 0.01194 Published 2026-07-20 Partial fix · 3.49.63-2.el8ap, 3.49.63-2.el9ap +7 CWE-22

TI-2026-32373 CVE-2026-44432 · GHSA-mf9v-mfxr-j63j

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

MEDIUM 40

urllib3 is an HTTP client library for Python.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.0068 Published 2026-05-13 Partial fix · 2.7.0 CWE-409

TI-2026-26183 CVE-2026-33811 · GHSA-497x-jcxf-m478

Crash when handling long CNAME response in net

MEDIUM 40

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00875 Published 2026-05-07 Partial fix · 1.25.10, 1.26.3 CWE-415

TI-2026-05545 CVE-2026-6321 · GHSA-q3j6-qgpj-74h6

fast-uri vulnerable to path traversal via percent-encoded dot segments

MEDIUM 40

fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00634 Published 2026-05-04 Partial fix · 3.1.1, 2.4.1 CWE-22

TI-2026-24810 CVE-2026-32281 · GHSA-gjvh-7jh8-7xhm

Inefficient policy validation in crypto/x509

LOW 39

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00361 Published 2026-04-08 Partial fix · 1.25.9, 1.26.2 CWE-295

TI-2026-05546 CVE-2026-6322 · GHSA-v39h-62p7-jpjc

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

LOW 39

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00512 Published 2026-05-05 Partial fix · 3.1.2, 2.4.1 CWE-436

TI-2026-09781 CVE-2026-11332 · GHSA-w8p5-mx5w-cpqj

Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

LOW 35

A flaw was found in ansible-core.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00222 Published 2026-06-05 Partial fix · 1:2.16.19-1.el8ap, 1:2.16.19-1.el9ap +33 CWE-88

TI-2026-31005 CVE-2026-42784 · GHSA-g33h-rrj9-75qv

Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

LOW 32

A flaw was found in sequoia-openpgp.

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.00313 Published 2026-09-16 Partial fix · 0.1.34-1.el9ap, 1.10.2.1-1.el10_2 +6 CWE-347

TI-2026-21586 CVE-2026-27136 · GHSA-m9x8-m34x-fj9q

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

LOW 27

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00223 Published 2026-05-22 Partial fix · 0.55.0 CWE-1021

TI-2026-20766 CVE-2026-25681 · GHSA-w9p8-pvxh-rxpj

Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

LOW 27

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00223 Published 2026-05-22 Partial fix · 0.55.0 CWE-1021

TI-2026-07594 CVE-2026-8643 · GHSA-wf93-45jw-7689

pip can extract console_scripts and gui_scripts outside installation directory

LOW 19

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation…

CVSS 4.0MEDIUM 4.1 Local Low privileges User interaction EPSS 0.0032 Published 2026-06-01 Partial fix · 26.1.2 CWE-22