RHSA-2026:71177

sqlparse is a non-validating SQL parser module for Python.

sqlparse is a non-validating SQL parser module for Python.

GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory.

lxml is a library for processing XML and HTML in the Python language.

GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard.

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD.

urllib3 is a user-friendly HTTP client library for Python.

A flaw was found in Red Hat Ansible Automation Platform's automation- controller.

A flaw was found in Red Hat Ansible Automation Platform's automation- controller.

A flaw was found in the Ansible Automation Platform automation-controller.

A flaw was found in Red Hat Ansible Automation Platform's automation- controller.

sqlparse is a non-validating SQL parser module for Python.

containerd is an open-source container runtime.

A flaw was found in AWX.

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace i…

GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False.

A flaw was found in Red Hat Ansible Automation Platform's automation- controller.

A flaw was found in Red Hat Ansible Automation Platform's automation- controller.

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error.

fast-uri serializes the port component of a URI without validating it.

CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC.

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation.

containerd is an open-source container runtime.

A flaw was found in the Ansible Automation Platform automation controller.

A flaw was found in Red Hat Ansible Automation Platform's automation- controller.

GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish strings to git read-tree…

A flaw was found in Ansible Automation Platform's automation-controller.

A flaw was found in the automation-controller input-validation guard sanitize_jinja().

A flaw was found in the Ansible Automation Platform automation-controller.

A flaw was found in the automation-controller API.

A container privilege escalation flaw was found in certain Ansible Automation Platform images.

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem.

A flaw was found in the automation-controller notification subsystem.

A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend.

A flaw was found in the Ansible Automation Platform automation-controller.

A flaw was found in the automation-controller instance install-bundle endpoint.

A flaw was found in Ansible Automation Platform's automation-controller (AWX).

JobJobEventsChildrenSummary view has no model/parent_model.

URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC.

HostList.list() catches bare Exception and returns str(e) verbatim.

A flaw was found in the Ansible Automation Platform automation-controller.

StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths.

/api/v2/config/ is protected only by IsAuthenticated.

RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob.

LaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash check, unlike Project/JobTemplate/JobLaunch serializers.

Notification template Jinja AST whitelist only inspects static Getattr nodes.