Red Hat Security Advisory

RHSA-2026:87120

Red Hat Ansible Automation Platform 2.6 Container Release Update

Released 2026-10-21 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9, registry.redhat.io/ansible-automation-platform-26/gateway-rhel9 +8

Fixes 23 records

TI-2026-65303 CVE-2026-102268 · GHSA-ffc3-869f-jxw9

Improper signature verification in jpadilla pyjwt

HIGH 80

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00236 Published 2026-09-28 Partial fix · 2.14.0 CWE-347

TI-2026-65637 CVE-2026-103262 · GHSA-h36x-fm6v-f9vx

Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

HIGH 77

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00628 Published 2026-10-01 Partial fix · 6.5.9 CWE-409

TI-2026-63063 CVE-2026-93599 · GHSA-g42g-9vm4-7gfj

rustls-webpki before 0.103.13 Panic via empty BIT STRING

HIGH 77

rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00346 Published 2026-09-18 Partial fix · 0.103.13, 0.104.0-alpha.7 CWE-191

TI-2026-65301 CVE-2026-102266 · GHSA-9j54-fg26-wv3r

PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

HIGH 74

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00225 Published 2026-09-28 Partial fix · 2.14.0 CWE-347

TI-2026-66136 CVE-2026-104851 · GHSA-27vj-qcqg-25rc

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

HIGH 73

fsspec is a specification and Python implementation framework for filesystem interfaces.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00475 Published 2026-10-02 Partial fix · 2026.6.0 CWE-1336

TI-2026-65307 CVE-2026-102272 · GHSA-r6x4-923q-g947

PyJWT BOM Bypass

HIGH 68

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00216 Published 2026-09-28 Partial fix · 2.14.0 CWE-347

TI-2026-65306 CVE-2026-102271 · GHSA-p4g4-x82p-q773

PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

HIGH 68

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00215 Published 2026-09-28 Partial fix · 2.14.0 CWE-347

TI-2026-63856 CVE-2026-96760 · GHSA-6m87-8wg6-hh8w · GHSA-6v38-4h7w-rj9h

Authlib library contains a signature‑verification bypass vulnerability

MEDIUM 49

Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00433 Published 2026-09-28 Partial fix · 1.9.0 CWE-20

TI-2026-45177 CVE-2026-63374 · GHSA-82r6-8w77-94w6

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

MEDIUM 48

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00289 Published 2026-09-22 Partial fix · 4.14.2 CWE-295

TI-2026-65302 CVE-2026-102267 · GHSA-9v7f-9g4p-ffgj

PyJWT: PyJWKClient follows redirects when fetching JWKS

MEDIUM 40

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00159 Published 2026-09-28 Partial fix · 2.14.0 CWE-200

TI-2026-28718 CVE-2026-39836 · GHSA-8g2r-hhvj-mv99

Panic in Dial and LookupPort when handling NUL byte on Windows in net

MEDIUM 40

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00633 Published 2026-05-07 Partial fix · 1.25.10, 1.26.3 CWE-476

TI-2026-74830 CVE-2026-92982 · GHSA-38c7-8hx4-q72m

Jinja2 template injection in Ansible Operator Plugins runs code

LOW 39

A flaw was found in Ansible Operator Plugins.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00472 Published 2026-10-15 Partial fix · 1791840864, 1792138238 +1 CWE-1336

TI-2026-65543 CVE-2026-102937 · GHSA-x78j-v8h9-3j2q

virtualenv: Command injection via --prompt in activate.bat (batch activator)

LOW 39

virtualenv is a tool for creating isolated virtual python environments.

CVSS 4.0HIGH 7.3 Local No auth User interaction EPSS 0.00208 Published 2026-09-29 Partial fix · 21.7.12 CWE-78

TI-2026-64264 CVE-2026-97689 · GHSA-vxq7-64xx-v4gw

urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

LOW 38

urllib3 is an HTTP client library for Python.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00335 Published 2026-09-29 Partial fix · 2.8.0 CWE-770

TI-2026-61819 CVE-2026-90959 · GHSA-mfxv-9hc5-3jv3

Path traversal in Red Hat Ansible Automation Platform 2.6 for RHEL 9

LOW 37

A path traversal vulnerability was found in pulpcore.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0041 Published 2026-09-24 Partial fix · 3.49.71-1.el9ap, 1791947385 +1 CWE-22

TI-2026-65542 CVE-2026-102930 · GHSA-94p9-xgh2-xp45

virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

LOW 35

virtualenv is a tool for creating isolated virtual python environments.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00197 Published 2026-09-29 Partial fix · 21.7.12 CWE-494

TI-2026-65541 CVE-2026-102925 · GHSA-p58f-9548-mpm2

virtualenv bash and fish activation scripts execute commands embedded in paths

LOW 35

virtualenv is a tool for creating isolated virtual python environments.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00159 Published 2026-09-29 Partial fix · 21.7.13 CWE-78

TI-2026-64262 CVE-2026-97687 · GHSA-8988-9cw3-xx77

urllib3: HTTPS proxy TLS configuration may be ignored or overridden

LOW 35

urllib3 is an HTTP client library for Python.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00206 Published 2026-09-29 Partial fix · 2.8.0 CWE-295

TI-2026-33552 CVE-2026-45820 · GHSA-px8p-9vwx-vf98

Uncontrolled resource consumption in 101arrowz fflate

LOW 35

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync().

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00279 Published 2026-07-22 Partial fix · 0.4.9, 0.5.4 +3 CWE-400

TI-2026-21866 CVE-2026-27459 · GHSA-5pwr-322w-8jr4

pyOpenSSL DTLS cookie callback buffer overflow

LOW 35

pyOpenSSL is a Python wrapper around the OpenSSL library.

CVSS 4.0HIGH 7.2 Network No auth No interaction EPSS 0.00748 Published 2026-03-17 Partial fix · 26.0.0 CWE-120

TI-2026-65308 CVE-2026-102273 · GHSA-w2cx-738m-mc7w

PyJWT accepts public JWK containers as HMAC secrets

LOW 34

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00175 Published 2026-09-28 Partial fix · 2.14.0 CWE-347

TI-2026-48582 CVE-2026-69243 · GHSA-mfx4-hv73-q22v

AIOHTTP: HTTP request smuggling via WebSocket upgrade

LOW 28

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00443 Published 2026-08-03 Partial fix · 3.14.2 CWE-444

TI-2026-65544 CVE-2026-102938 · GHSA-9h9j-4vrj-gf7g

virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

LOW 25

virtualenv is a tool for creating isolated virtual python environments.

CVSS 4.0MEDIUM 5.8 Local No auth User interaction EPSS 0.00146 Published 2026-09-29 Partial fix · 21.7.11 CWE-93