Red Hat Security AdvisoryRHSA-2026:59136
Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
Released 2026-08-24 · Red Hat rating Important · View on Red Hat →
Fixes 20 records
Priority HIGH 77
GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clone destination.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00651 · Published 2026-08-25 · Partial fix · 3.1.59 CWE-22
Priority HIGH 77
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from().
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00328 · Published 2026-08-01 · Partial fix · 3.1.52 CWE-200
Priority HIGH 77
form-data is a library for creating readable multipart/form-data streams.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00669 · Published 2026-06-12 · Partial fix · 2.5.6, 3.0.5 +1 CWE-93
Priority HIGH 73
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature.
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.02209 · Published 2026-08-01 · Partial fix · 3.1.51 CWE-78
Priority HIGH 72
GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbi…
CVSS 4.0HIGH 8.6· Local · No auth · No interaction · EPSS 0.01251 · Published 2026-08-01 · Partial fix · 3.1.51 CWE-77
Priority HIGH 69
tmp is a temporary file and directory creator for node.js.
CVSS 4.0HIGH 7.7· Network · No auth · No interaction · EPSS 0.00434 · Published 2026-06-11 · Partial fix · 0.2.6 CWE-22
Priority HIGH 67
GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs.
CVSS 4.0HIGH 7.2· Network · Low privileges · No interaction · EPSS 0.00574 · Published 2026-08-13 · Partial fix · 3.1.57 CWE-22
Priority MEDIUM 64
GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00316 · Published 2026-08-25 · Partial fix · 3.1.59 CWE-73
Priority MEDIUM 63
JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00306 · Published 2026-04-07 · Partial fix · 1.5.7 CWE-409
Priority MEDIUM 48
GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00454 · Published 2026-08-01 · Partial fix · 3.1.51 CWE-78
Priority MEDIUM 42
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.01134 · Published 2026-08-04 · Partial fix · 6.0.8, 5.2.17 CWE-73
Priority LOW 39
pyasn1 is a generic ASN.1 library for Python.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0044 · Published 2026-07-14 · Partial fix · 0.6.4 CWE-400
Priority LOW 39
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00328 · Published 2026-06-03 · Fixed in 4.2.2 CWE-770
Priority LOW 37
A path traversal vulnerability was found in AWX's project archive extraction.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01722 · Published 2026-08-24 · Fixed in 4.6.32-1.el8ap, 4.6.32-1.el9ap +3 CWE-22
Priority LOW 34
A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends.
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.00562 · Published 2026-08-24 · Fixed in 4.6.32-1.el8ap, 4.6.32-1.el9ap +3 CWE-918
Priority LOW 34
A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism.
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.00493 · Published 2026-08-18 · Fixed in 4.6.32-1.el8ap, 4.6.32-1.el9ap +3 CWE-918
Priority LOW 32
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
CVSS 4.0HIGH 7.1· Network · No auth · User interaction · EPSS 0.00528 · Published 2026-08-03 · Partial fix · 3.14.3 CWE-125
Priority LOW 31
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
CVSS 3.1HIGH 7.3· Local · Low privileges · User interaction · EPSS 0.00179 · Published 2026-06-02 · Partial fix · 3.14.0 CWE-502
Priority LOW 28
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00443 · Published 2026-08-03 · Partial fix · 3.14.2 CWE-444
Priority LOW 21
A path traversal vulnerability was found in awxkit, the CLI tool for AWX.
CVSS 3.1MEDIUM 4.7· Local · No auth · User interaction · EPSS 0.00128 · Published 2026-06-09 · Partial fix · 4.6.32-1.el8ap, 4.6.32-1.el9ap +3 CWE-22
THREATIST.IORead the docs