The vulnerability in Red Hat Ansible Automation Platform 2's awxkit CLI tool involves improper limitation of a pathname to a restricted directory, specifically through the YAML !include directive. This directive fails to sanitize file paths, enabling an attacker to create a malicious YAML file that, when imported with the command "awx --conf.format yaml import", can read arbitrary YAML files from the local filesystem. Exploitation requires the user to import a crafted YAML file, making this a client-side vulnerability with limited attack vector scope.

Successful exploitation allows an attacker to read arbitrary YAML-formatted files on the local filesystem of the client running the awx CLI tool. This can lead to disclosure of sensitive configuration or data files. The vulnerability does not allow code execution or modification of data, but the confidentiality impact is high. Exploitation requires user interaction and local access to run the import command with a malicious YAML file.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-52902 for current remediation guidance. Until an official fix is available, users should avoid importing YAML files from untrusted sources using the awx CLI tool to prevent exploitation. Monitor the vendor advisory for updates on patches or workarounds.