VulnerabilityPublished 23 Jun 2026Updated 6 Sep 2026

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Container Release Update

Affects Red HatSource GCVE Database

Severity

Critical

Rated by Threat Radar

Data as of 26 Oct 2026, 15:55 UTC

What to do

Affected software

Product	Affected	Fixed in
Red Hat Product Security Red Hat	Affected Red Hat Red Hat Ansible Automation Platform Red Hat Ansible Automation Platform 2.7 amd64 registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:1d7336a746b35764d705c3a68f0f0e2a8426eaa1e75f504b193900fcdcdb80ec_amd64	Fixed in–

AI-suggested

Patch status and remediation details are not provided in the advisory content. Users should consult the official Red Hat advisory RHSA-2026:28440 and associated release notes for current remediation guidance and apply updates as recommended by Red Hat Product Security.

Description

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. For details about this release, refer to the release notes listed in the References section.

Impact

The advisory does not specify any particular security impact or vulnerabilities. Without detailed vulnerability information or CVEs, the exact impact cannot be determined from the provided data.

Summary

Red Hat issued a security advisory (RHSA-2026:28440) for the Ansible Automation Platform 2.7 container release update. The advisory describes the product and its purpose but does not disclose specific vulnerabilities, CVEs, or technical details about the security issues addressed.

CWE-862Missing Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #4OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries.
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
OWASP Cheat Sheets
Authorization (opens in a new tab)
OWASP ASVS 4.0.3
V8.3.8 (opens in a new tab)
V13.4.2 (opens in a new tab)
V7.2.2 (opens in a new tab)
Attack patterns
Exploitation of Thunderbolt Protection Flaws (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 23 Jun 2026, 17:54 UTC

WeaknessesCWE-862

Technical details

References

Community reviews

Related threats