Red Hat Ansible Automation Platform 2.6 contains numerous critical vulnerabilities across its components. Key issues include remote code execution via Git directory impersonation and Git argument injection, privilege escalation through workflow job template copy and instance-group permission bypasses, unauthorized disclosure of credentials and job outputs, denial of service via Jinja rendering and malformed MIME headers, cross-site scripting via job output, and server-side request forgery via credential tests. These vulnerabilities stem from improper input validation, insufficient access controls, and unsafe handling of user-supplied data in automation-controller, automation-gateway-proxy, and automation-platform-ui modules. The advisory lists over 40 CVEs fixed in this update, reflecting a broad security impact on the platform.

The vulnerabilities collectively allow attackers to execute arbitrary code remotely, escalate privileges within the automation platform, disclose sensitive credentials and job data, cause denial of service conditions, and bypass authentication or authorization controls. This could lead to full compromise of the automation environment, unauthorized access to secrets, and disruption of automation workflows. The critical severity rating reflects the potential for significant operational and security impact if exploited.

Red Hat has released an official security advisory (RHSA-2026:71113) providing updates that address these vulnerabilities in Red Hat Ansible Automation Platform 2.6. Users should apply the provided patches promptly to remediate the issues. Since this is not a cloud service, remediation depends on applying vendor-supplied updates. No additional mitigation steps are specified beyond applying the official fixes.