Red Hat Security Advisory: Ansible automation portal Red Hat Enterprise Linux Images

Red Hat Ansible Automation Platform versions 2.1 and 2.2 include Ansible plug-ins for Red Hat Developer Hub that enhance automation. A Red Hat security advisory (RHSA-2026:65118) lists multiple CVEs including CVE-2026-5079 but does not provide specific vulnerability details or confirm patches. Updated images with new features and bug fixes are available, but no explicit fixes for the listed CVEs are stated.

• CWE-776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') (opens in a new tab)

  Base weaknessLikelihood of exploit: MediumOWASP Top 10 A02:2025: Security Misconfiguration (opens in a new tab)

  The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

  How to prevent and test

  1. Operation

     If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.

  2. Implementation

     Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.

  OWASP Cheat Sheets

  • File Upload (opens in a new tab)

  OWASP ASVS 4.0.3

  • V12.1.1 (opens in a new tab)

  Attack patterns

  • Exponential Data Expansion (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-835Loop with Unreachable Exit Condition ('Infinite Loop') (opens in a new tab)

  Base weakness

  The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

• CWE-839Numeric Range Comparison Without Minimum Check (opens in a new tab)

  Base weakness

  The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.

  How to prevent and test

  1. Implementation · Enforcement by Conversion

     If the number to be used is always expected to be positive, change the variable type from signed to unsigned or size_t.

  2. Implementation · Input Validation

     If the number to be used could have a negative value based on the specification (thus requiring a signed value), but the number should only be positive to preserve code correctness, then include a check to ensure that the value is positive.

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-674Uncontrolled Recursion (opens in a new tab)

  Class weakness

  The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

  How to prevent and test

  1. Implementation

     Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.

  2. Implementation

     Increase the stack size.

  Attack patterns

  • Serialized Data with Nested Payloads (opens in a new tab)
  • Oversized Serialized Data Payloads (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes (opens in a new tab)

  Base weaknessOWASP Top 10 A08:2025: Software or Data Integrity Failures (opens in a new tab)

  The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

  How to prevent and test

  1. Implementation

     If available, use features of the language or framework that allow specification of allowlists of attributes or fields that are allowed to be modified. If possible, prefer allowlists over denylists.

  2. Architecture and Design · Implementation

     If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.

  3. Implementation · Input Validation

     For any externally-influenced input, check the input against an allowlist of internal object attributes or fields that are allowed to be modified.

  OWASP Cheat Sheets

  • Mass Assignment (opens in a new tab)
  • Software Supply Chain Security (opens in a new tab)
  • Infrastructure as Code (opens in a new tab)

  OWASP ASVS 4.0.3

  • V5.1.2 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)

  Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25

  The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

  How to prevent and test

  1. Requirements

     Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.

  2. Architecture and Design

     Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

  3. Architecture and Design

     Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.

  OWASP Cheat Sheets

  • Abuse Case (opens in a new tab)

  OWASP ASVS 4.0.3

  • V8.1.4 (opens in a new tab)
  • V13.4.1 (opens in a new tab)
  • V11.1.4 (opens in a new tab)

  Attack patterns

  • XML Ping of the Death (opens in a new tab)
  • Exponential Data Expansion (opens in a new tab)
  • Serialized Data Parameter Blowup (opens in a new tab)
  • Serialized Data with Nested Payloads (opens in a new tab)
  • Oversized Serialized Data Payloads (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-1289Improper Validation of Unsafe Equivalence in Input (opens in a new tab)

  Base weakness

  The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.

  How to prevent and test

  1. Implementation · Input Validation

     Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • Mass Assignment (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.1 (opens in a new tab)
  • V5.1.4 (opens in a new tab)
  • V5.1.3 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)

  Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #1OWASP Top 10 A05:2025: Injection (opens in a new tab)

  The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

  How to prevent and test

  1. Architecture and Design · Libraries or Frameworks

     Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

  2. Implementation · Architecture and Design

     Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages.

  3. Architecture and Design · Implementation · Attack Surface Reduction

     Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide…

  OWASP Cheat Sheets

  • Cross Site Scripting Prevention (opens in a new tab)
  • DOM based XSS Prevention (opens in a new tab)
  • Injection Prevention (opens in a new tab)
  • Abuse Case (opens in a new tab)
  • Deserialization (opens in a new tab)

  OWASP ASVS 4.0.3

  • V5.3.3 (opens in a new tab)
  • V1.5.1 (opens in a new tab)

  Attack patterns

  • XSS Using MIME Type Mismatch (opens in a new tab)
  • DOM-Based XSS (opens in a new tab)
  • Reflected XSS (opens in a new tab)
  • Stored XSS (opens in a new tab)
  • Cross-Site Scripting (XSS) (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-140Improper Neutralization of Delimiters (opens in a new tab)

  Base weakness

  The product does not neutralize or incorrectly neutralizes delimiters.

  How to prevent and test

  1. Implementation · Input Validation

     Developers should anticipate that delimiters will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.

  2. Implementation · Input Validation

     Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

  3. Implementation · Output Encoding

     While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments.

  OWASP Cheat Sheets

  • Abuse Case (opens in a new tab)
  • Deserialization (opens in a new tab)
  • Server Side Request Forgery Prevention (opens in a new tab)
  • Unvalidated Redirects and Forwards (opens in a new tab)
  • Cross Site Scripting Prevention (opens in a new tab)

  OWASP ASVS 4.0.3

  • V1.5.1 (opens in a new tab)
  • V5.2.2 (opens in a new tab)

  Attack patterns

  • Command Delimiters (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') (opens in a new tab)

  Base weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)

  The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

  How to prevent and test

  1. Implementation

     Use a web server that employs a strict HTTP parsing procedure, such as Apache.

  2. Implementation

     Use only SSL communication.

  3. Implementation

     Terminate the client session after each request.

  OWASP Cheat Sheets

  • REST Assessment (opens in a new tab)
  • REST Security (opens in a new tab)
  • Cross-Site Request Forgery Prevention (opens in a new tab)
  • Secure Design Principles (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.2.5 (opens in a new tab)

  Attack patterns

  • HTTP Response Smuggling (opens in a new tab)
  • HTTP Request Smuggling (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-918Server-Side Request Forgery (SSRF) (opens in a new tab)

  Base weaknessCWE Top 25 (2025): #22OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)

  The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

  How to prevent and test

  OWASP Cheat Sheets

  • Server Side Request Forgery Prevention (opens in a new tab)
  • Unvalidated Redirects and Forwards (opens in a new tab)
  • Cross Site Scripting Prevention (opens in a new tab)
  • DOM based XSS Prevention (opens in a new tab)
  • Authorization (opens in a new tab)

  OWASP ASVS 4.0.3

  • V12.6.1 (opens in a new tab)
  • V5.2.6 (opens in a new tab)

  Attack patterns

  • Server Side Request Forgery (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-76Improper Neutralization of Equivalent Special Elements (opens in a new tab)

  Base weaknessLikelihood of exploit: HighOWASP Top 10 A05:2025: Injection (opens in a new tab)

  The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.

  How to prevent and test

  1. Requirements

     Programming languages and supporting technologies might be chosen which are not subject to these issues.

  2. Implementation

     Utilize an appropriate mix of allowlist and denylist parsing to filter equivalent special element syntax from all input.

  OWASP Cheat Sheets

  • Abuse Case (opens in a new tab)
  • Deserialization (opens in a new tab)
  • Injection Prevention (opens in a new tab)
  • SQL Injection Prevention (opens in a new tab)
  • Injection Prevention in Java (opens in a new tab)

  OWASP ASVS 4.0.3

  • V1.5.1 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection') (opens in a new tab)

  Base weaknessOWASP Top 10 A05:2025: Injection (opens in a new tab)

  The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

  How to prevent and test

  1. Implementation

     Avoid using CRLF as a special sequence.

  2. Implementation

     Appropriately filter or quote CRLF sequences in user-controlled input.

  OWASP Cheat Sheets

  • Abuse Case (opens in a new tab)
  • Deserialization (opens in a new tab)
  • Injection Prevention (opens in a new tab)
  • SQL Injection Prevention (opens in a new tab)
  • Injection Prevention in Java (opens in a new tab)

  OWASP ASVS 4.0.3

  • V1.5.1 (opens in a new tab)

  Attack patterns

  • Command Delimiters (opens in a new tab)
  • Web Server Logs Tampering (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-434Unrestricted Upload of File with Dangerous Type (opens in a new tab)

  Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #12OWASP Top 10 A06:2025: Insecure Design (opens in a new tab)

  The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

  How to prevent and test

  1. Architecture and Design

     Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.

  2. Architecture and Design · Enforcement by Conversion

     When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.

  3. Architecture and Design

     Consider storing the uploaded files outside of the web document root entirely. Then, use other mechanisms to deliver the files dynamically.

  OWASP Cheat Sheets

  • Server Side Request Forgery Prevention (opens in a new tab)
  • Web Service Security (opens in a new tab)
  • Third Party Javascript Management (opens in a new tab)
  • File Upload (opens in a new tab)
  • Secure Design Principles (opens in a new tab)

  OWASP ASVS 4.0.3

  • V12.5.2 (opens in a new tab)
  • V13.1.5 (opens in a new tab)
  • V12.2.1 (opens in a new tab)

  Attack patterns

  • Accessing Functionality Not Properly Constrained by ACLs (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-606Unchecked Input for Loop Condition (opens in a new tab)

  Base weakness

  The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.

  How to prevent and test

  1. Implementation

     Do not use user-controlled data for loop conditions.

  2. Implementation

     Perform input validation.

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • Mass Assignment (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.1 (opens in a new tab)
  • V5.1.4 (opens in a new tab)
  • V5.1.3 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-1333Inefficient Regular Expression Complexity (opens in a new tab)

  Base weaknessLikelihood of exploit: High

  The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

  How to prevent and test

  1. Architecture and Design

     Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.

  2. System Configuration

     Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.

  3. Implementation

     Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.

  OWASP Cheat Sheets

  • File Upload (opens in a new tab)

  OWASP ASVS 4.0.3

  • V12.1.1 (opens in a new tab)

  Attack patterns

  • Regular Expression Exponential Blowup (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-1389Incorrect Parsing of Numbers with Different Radices (opens in a new tab)

  Base weakness

  The product parses numeric input assuming base 10 (decimal) values, but it does not account for inputs that use a different base number (radix).

  How to prevent and test

  1. Implementation · Enforcement by Conversion

     If only decimal-based values are expected in the application, conditional checks should be created in a way that prevent octal or hexadecimal strings from being checked.

  2. Implementation · Input Validation

     If various numerical bases do need to be supported, check for leading values indicating the non-decimal base you wish to support (such as 0x for hex) and convert the numeric strings to integers of the respective base. Reject any other alternative-base string that is not intentionally supported by the application.

  3. Implementation · Input Validation

     If regular expressions are used to validate IP addresses, ensure that they are bounded using ^ and $ to prevent base-prepended IP addresses from being matched.

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• access.redhat.com/errata/RHSA-2026:65118 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-5079 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-67213 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-67214 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-67313 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-67314 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-67320 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-67321 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-73563 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-73566 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-75838 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-75899 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-75931 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-75975 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-76172 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-84292 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-84394 (opens in a new tab)
• access.redhat.com/security/updates/classification/ (opens in a new tab)
• docs.redhat.com/en/documentation/red_hat_ansible_automation_platform (opens in a new tab)
• security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65118.json (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:66003 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-12143 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-14257 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-15307 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-54272 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-59869 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-67422 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-69152 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-69192 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-73569 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-73643 (opens in a new tab)
• security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66003.json (opens in a new tab)

• Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.CriticalVulnerability10/22/2026
• Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.CriticalVulnerability10/22/2026
• Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.CriticalVulnerability10/22/2026
• Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.CriticalVulnerability10/22/2026
• Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.CriticalVulnerability10/22/2026