CVE-2025-62718VulnerabilityPublished 9 Jun 2026Updated 27 Oct 2026

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Affects Red HatSource GCVE Database

Mentioned vulnerabilities

Not known to be exploited.

Data as of 27 Oct 2026, 06:28 UTC

Severity

High

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 1.1% chance of exploitation in 30 days – higher than 67% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 9 Jun 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Red Hat Product Security Red Hat	Affected Red Hat Red Hat Ansible Automation Platform Red Hat Ansible Automation Platform 2.5 for RHEL 9	Fixed in–

Description

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: Cryptography: Buffer overflow via non-contiguous buffer in API (CVE-2026-39892) * automation-controller: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922) * automation-gateway: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization (CVE-2025-62718) * automation-gateway: Vite: Information disclosure via WebSocket connection bypasses access control (CVE-2026-39363) * automation-gateway: node-forge: Denial of Service via infinite loop in BigInteger.modInverse() (CVE-2026-33891) * automation-gateway: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification (CVE-2026-33894) * automation-gateway: Forge: Authentication bypass via forged Ed25519 cryptographic signatures (CVE-2026-33895) * automation-gateway: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance (CVE-2026-33896) * automation-gateway: path-to-regexp: Denial of Service via crafted regular expressions (CVE-2026-4926) * automation-gateway: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904) * automation-gateway: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996) * automation-gateway-proxy: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * automation-gateway-proxy: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) * python3.12-click: Arbitrary command execution via command injection in click.edit() (CVE-2026-7246) * python3.12-cryptography: Buffer overflow via non-contiguous buffer in API (CVE-2026-39892) * python3.12-pillow: Denial of Service via decompression bomb in FITS image processing (CVE-2026-40192) * receptor: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * receptor: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) * receptor: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details about this release, refer to the release notes listed in the References section.

CWE-1289Improper Validation of Unsafe Equivalence in Input (opens in a new tab)
Base weakness
The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-1333Inefficient Regular Expression Complexity (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Architecture and Design
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
System Configuration
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Implementation
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
OWASP Cheat Sheets
File Upload (opens in a new tab)
OWASP ASVS 4.0.3
V12.1.1 (opens in a new tab)
Attack patterns
Regular Expression Exponential Blowup (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #9OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Architecture and Design
If at all possible, use library calls rather than external processes to recreate the desired functionality.
Architecture and Design · Operation · Sandbox or Jail
Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
Architecture and Design · Attack Surface Reduction
For any data that will be used to generate a command to be executed, keep as much of that data out of external control as possible. For example, in web applications, this may require storing the data locally in the session's state instead of sending it out to the client in a hidden form field.
OWASP Cheat Sheets
Injection Prevention (opens in a new tab)
Injection Prevention in Java (opens in a new tab)
OS Command Injection Defense (opens in a new tab)
Abuse Case (opens in a new tab)
Deserialization (opens in a new tab)
OWASP ASVS 4.0.3
V12.3.5 (opens in a new tab)
V5.3.8 (opens in a new tab)
V1.5.1 (opens in a new tab)
Attack patterns
Command Line Execution through SQL Injection (opens in a new tab)
Command Delimiters (opens in a new tab)
Exploiting Multiple Input Interpretation Layers (opens in a new tab)
Argument Injection (opens in a new tab)
OS Command Injection (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop') (opens in a new tab)
Base weakness
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Requirements
Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and Design
Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
OWASP ASVS 4.0.3
V8.1.4 (opens in a new tab)
V13.4.1 (opens in a new tab)
V11.1.4 (opens in a new tab)
Attack patterns
XML Ping of the Death (opens in a new tab)
Exponential Data Expansion (opens in a new tab)
Serialized Data Parameter Blowup (opens in a new tab)
Serialized Data with Nested Payloads (opens in a new tab)
Oversized Serialized Data Payloads (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Implementation
The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
Implementation
When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
Architecture and Design
Limit the interleaving of operations on files from multiple processes.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
OWASP ASVS 4.0.3
V1.11.3 (opens in a new tab)
V11.1.6 (opens in a new tab)
V1.11.2 (opens in a new tab)
Attack patterns
Leveraging Race Conditions via Symbolic Links (opens in a new tab)
Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-764Multiple Locks of a Critical Resource (opens in a new tab)
Base weakness
The product locks a critical resource more times than intended, leading to an unexpected state in the system.
Implementation
When locking and unlocking a resource, try to be sure that all control paths through the code in which the resource is locked one or more times correspond to exactly as many unlocks.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-606Unchecked Input for Loop Condition (opens in a new tab)
Base weakness
The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
Implementation
Do not use user-controlled data for loop conditions.
Implementation
Perform input validation.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-347Improper Verification of Cryptographic Signature (opens in a new tab)
Base weaknessOWASP Top 10 A04:2025: Cryptographic Failures (opens in a new tab)
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
OWASP Cheat Sheets
XML Security (opens in a new tab)
REST Security (opens in a new tab)
JSON Web Token for Java (opens in a new tab)
REST Assessment (opens in a new tab)
Cross-Site Request Forgery Prevention (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.2 (opens in a new tab)
V3.5.3 (opens in a new tab)
V13.2.6 (opens in a new tab)
Attack patterns
Padding Oracle Crypto Attack (opens in a new tab)
Signature Spoofing by Improper Validation (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-295Improper Certificate Validation (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not validate, or incorrectly validates, a certificate.
Architecture and Design · Implementation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
OWASP Cheat Sheets
Transport Layer Protection (opens in a new tab)
TLS Cipher String (opens in a new tab)
OWASP Authentication (opens in a new tab)
OWASP ASVS 4.0.3
V9.2.1 (opens in a new tab)
V1.9.2 (opens in a new tab)
V2.8.5 (opens in a new tab)
Attack patterns
Creating a Rogue Certification Authority Certificate (opens in a new tab)
Signature Spoofing by Improper Validation (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-1220Insufficient Granularity of Access Control (opens in a new tab)
Base weakness
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
Architecture and Design · Implementation · Testing
Access-control-policy protections must be reviewed for design inconsistency and common weaknesses.; Access-control-policy definition and programming flow must be tested in pre-silicon, post-silicon testing.
OWASP Cheat Sheets
Docker Security (opens in a new tab)
Third Party Javascript Management (opens in a new tab)
Virtual Patching (opens in a new tab)
OWASP ASVS 4.0.3
V1.4.4 (opens in a new tab)
V1.4.5 (opens in a new tab)
V1.10.1 (opens in a new tab)
Attack patterns
Accessing Functionality Not Properly Constrained by ACLs (opens in a new tab)
Exploiting Incorrectly Configured Access Control Security Levels (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-131Incorrect Calculation of Buffer Size (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
Implementation
When allocating a buffer for the purpose of transforming, converting, or encoding an input, allocate enough memory to handle the largest possible encoding. For example, in a routine that converts "&" characters to "&" for HTML entity encoding, the output buffer needs to be at least 5 times as large as the input…
Implementation
Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles…
Implementation · Input Validation
Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
Attack patterns
Overflow Buffers (opens in a new tab)
Buffer Overflow via Parameter Expansion (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-409Improper Handling of Highly Compressed Data (Data Amplification) (opens in a new tab)
Base weakness
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
OWASP Cheat Sheets
File Upload (opens in a new tab)
OWASP ASVS 4.0.3
V12.1.2 (opens in a new tab)
V12.1.1 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

GCVE source: db.gcve.eu
Csaf Category: csaf_security_advisory
Csaf Version: 2.0
Publisher: Red Hat Product Security
Advisory ID: RHSA-2026:24761
Vendor Severity: high
CVE Count: 16
Additional Cves: CVE-2026-4926, CVE-2026-7246, CVE-2026-26996, CVE-2026-27904, CVE-2026-30922, CVE-2026-32280, CVE-2026-32282, CVE-2026-32283, CVE-2026-33891, CVE-2026-33894, CVE-2026-33895, CVE-2026-33896, CVE-2026-39363, CVE-2026-39892, CVE-2026-40192

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

WeaknessesCWE-1289, CWE-1333, CWE-78 +10

Technical details

References

Community reviews

Related threats