Red Hat Security Advisory

RHSA-2026:87124

Red Hat Ansible Automation Platform 2.7 Container Release Update

Released 2026-10-21 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/de-supported-rhel9, registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-supported-rhel9 +8

Fixes 21 records

TI-2026-65303 CVE-2026-102268 · GHSA-ffc3-869f-jxw9

Improper signature verification in jpadilla pyjwt

HIGH 80

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00236 Published 2026-09-28 Partial fix · 2.14.0 CWE-347

TI-2026-65637 CVE-2026-103262 · GHSA-h36x-fm6v-f9vx

Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

HIGH 77

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00628 Published 2026-10-01 Partial fix · 6.5.9 CWE-409

TI-2026-65301 CVE-2026-102266 · GHSA-9j54-fg26-wv3r

PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

HIGH 74

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00225 Published 2026-09-28 Partial fix · 2.14.0 CWE-347

TI-2026-66136 CVE-2026-104851 · GHSA-27vj-qcqg-25rc

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

HIGH 73

fsspec is a specification and Python implementation framework for filesystem interfaces.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00475 Published 2026-10-02 Partial fix · 2026.6.0 CWE-1336

TI-2026-65307 CVE-2026-102272 · GHSA-r6x4-923q-g947

PyJWT BOM Bypass

HIGH 68

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00216 Published 2026-09-28 Partial fix · 2.14.0 CWE-347

TI-2026-65306 CVE-2026-102271 · GHSA-p4g4-x82p-q773

PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

HIGH 68

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00215 Published 2026-09-28 Partial fix · 2.14.0 CWE-347

TI-2026-45177 CVE-2026-63374 · GHSA-82r6-8w77-94w6

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

MEDIUM 48

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00289 Published 2026-09-22 Partial fix · 4.14.2 CWE-295

TI-2026-59934 CVE-2026-87817 · GHSA-239g-whfq-7xj9

GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation

MEDIUM 46

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00419 Published 2026-09-09 Partial fix · 3.1.60 CWE-94

TI-2026-65302 CVE-2026-102267 · GHSA-9v7f-9g4p-ffgj

PyJWT: PyJWKClient follows redirects when fetching JWKS

MEDIUM 40

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00159 Published 2026-09-28 Partial fix · 2.14.0 CWE-200

TI-2026-74830 CVE-2026-92982 · GHSA-38c7-8hx4-q72m

Jinja2 template injection in Ansible Operator Plugins runs code

LOW 39

A flaw was found in Ansible Operator Plugins.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00472 Published 2026-10-15 Partial fix · 1791840864, 1792138238 +1 CWE-1336

TI-2026-65543 CVE-2026-102937 · GHSA-x78j-v8h9-3j2q

virtualenv: Command injection via --prompt in activate.bat (batch activator)

LOW 39

virtualenv is a tool for creating isolated virtual python environments.

CVSS 4.0HIGH 7.3 Local No auth User interaction EPSS 0.00208 Published 2026-09-29 Partial fix · 21.7.12 CWE-78

TI-2026-64264 CVE-2026-97689 · GHSA-vxq7-64xx-v4gw

urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

LOW 38

urllib3 is an HTTP client library for Python.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00335 Published 2026-09-29 Partial fix · 2.8.0 CWE-770

TI-2026-61819 CVE-2026-90959 · GHSA-mfxv-9hc5-3jv3

Path traversal in Red Hat Ansible Automation Platform 2.6 for RHEL 9

LOW 37

A path traversal vulnerability was found in pulpcore.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0041 Published 2026-09-24 Partial fix · 3.49.71-1.el9ap, 1791947385 +1 CWE-22

TI-2026-65542 CVE-2026-102930 · GHSA-94p9-xgh2-xp45

virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

LOW 35

virtualenv is a tool for creating isolated virtual python environments.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00197 Published 2026-09-29 Partial fix · 21.7.12 CWE-494

TI-2026-65541 CVE-2026-102925 · GHSA-p58f-9548-mpm2

virtualenv bash and fish activation scripts execute commands embedded in paths

LOW 35

virtualenv is a tool for creating isolated virtual python environments.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00159 Published 2026-09-29 Partial fix · 21.7.13 CWE-78

TI-2026-64262 CVE-2026-97687 · GHSA-8988-9cw3-xx77

urllib3: HTTPS proxy TLS configuration may be ignored or overridden

LOW 35

urllib3 is an HTTP client library for Python.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00206 Published 2026-09-29 Partial fix · 2.8.0 CWE-295

TI-2026-21866 CVE-2026-27459 · GHSA-5pwr-322w-8jr4

pyOpenSSL DTLS cookie callback buffer overflow

LOW 35

pyOpenSSL is a Python wrapper around the OpenSSL library.

CVSS 4.0HIGH 7.2 Network No auth No interaction EPSS 0.00748 Published 2026-03-17 Partial fix · 26.0.0 CWE-120

TI-2026-09781 CVE-2026-11332 · GHSA-w8p5-mx5w-cpqj

Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

LOW 35

A flaw was found in ansible-core.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00222 Published 2026-06-05 Partial fix · 1:2.16.19-1.el8ap, 1:2.16.19-1.el9ap +33 CWE-88

TI-2026-65308 CVE-2026-102273 · GHSA-w2cx-738m-mc7w

PyJWT accepts public JWK containers as HMAC secrets

LOW 34

PyJWT is a Python implementation of JSON Web Token standards.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00175 Published 2026-09-28 Partial fix · 2.14.0 CWE-347

TI-2026-63427 CVE-2026-94416 · GHSA-ch6h-xwwm-655w

Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery

LOW 31

An authorization bypass was found in the Ansible Automation Platform (AAP) gateway.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00544 Published 2026-09-24 Partial fix · 2.6.20261019-1.el9ap, 1792429216 CWE-290

TI-2026-65544 CVE-2026-102938 · GHSA-9h9j-4vrj-gf7g

virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

LOW 25

virtualenv is a tool for creating isolated virtual python environments.

CVSS 4.0MEDIUM 5.8 Local No auth User interaction EPSS 0.00146 Published 2026-09-29 Partial fix · 21.7.11 CWE-93