This Red Hat Security Advisory for Ansible Automation Platform 2.5 details multiple critical vulnerabilities fixed in the automation-controller and related components. Notable issues include remote code execution via Git directory impersonation (CVE-2026-87817), command injection, privilege escalation, cross-tenant credential exposure, server-side request forgery (CVE-2026-12564), and denial of service vulnerabilities in dependencies such as brace-expansion, PostCSS, js-yaml, and Go libraries. The advisory lists over 40 CVEs addressing a broad spectrum of security weaknesses including injection flaws, information disclosure, and privilege escalation vectors. The update is critical to protect enterprise automation environments from exploitation.

The vulnerabilities collectively pose significant risks including remote code execution, unauthorized disclosure of sensitive credentials and secrets, privilege escalation within automation workflows, denial of service conditions, and cross-tenant data exposure. Exploitation could allow attackers to execute arbitrary code, escalate privileges, access confidential data, disrupt automation services, or bypass access controls in enterprise environments using Red Hat Ansible Automation Platform 2.5. These impacts could compromise the confidentiality, integrity, and availability of automation operations and underlying infrastructure.

An update for Red Hat Ansible Automation Platform 2.5 is available that addresses these critical security vulnerabilities. Users should apply this official fix promptly to remediate the issues. Since this is an on-premises product, administrators must manually deploy the updated packages as per Red Hat's advisory instructions. No additional mitigations are indicated beyond applying the vendor-provided update.