Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Container Release Update
Affects Red HatSource GCVE Database
Not known to be exploited · CVSS 6.4 Medium.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H- Attack Vector
- Local
- Attack Complexity
- High
- Privileges Required
- High
- User Interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Bold values are the worst case: easiest to exploit or largest impact.
- Attack Vector: Local
- The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., tricking a legitimate user into opening a malicious document).
- Attack Complexity: High
- A successful attack depends on conditions beyond the attacker's control. That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected. For example, a successful attack may require an attacker to: gather knowledge about the environment in which the vulnerable target/component exists; prepare the target environment to improve exploit reliability; or inject themselves into the logical network path between the target and the resource requested by the victim in order to read and/or modify network communications (e.g., a man in the middle attack).
- Privileges Required: High
- The attacker is authorized with (i.e., requires) privileges that provide significant (e.g., administrative) control over the vulnerable component that could affect component-wide settings and files.
- User Interaction: None
- The vulnerable system can be exploited without any interaction from any user.
- Scope: Unchanged
- An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
- Confidentiality: High
- There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
- Integrity: High
- There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
- Availability: High
- There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).
Definitions: FIRST CVSS v3.1 specification.
Exploitation evidence
Disclosed: evidence found.
CVE published 8 Apr 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
- Disclosed
- The CVE record is public on cve.org. Its publication is t = 0.
- Detectable
- A public nuclei template can find exposed instances, for defenders and attackers alike.
- Weaponised
- Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
- Exploited in the wild
- CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
- Observed by OffSeq Mirage
- OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.
Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Red Hatredhat/redhat-ansible-automation-platformpkg:rpm/redhat/redhat-ansible-automation-platformOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A security update is available for Red Hat Ansible Automation Platform 2.7 container images. Users should apply this update promptly after ensuring all previously released errata relevant to their system have been installed. Detailed upgrade instructions are provided in the vendor documentation. No additional mitigation steps are indicated beyond applying the official update.
Description
Red Hat Ansible Automation Platform 2.7 Container Release Update addresses multiple security vulnerabilities in the enterprise IT automation framework. The update fixes numerous bugs and security issues affecting the platform's containerized components, improving the security posture of automation deployments. Users are advised to apply this update after ensuring all previous errata are installed.
Impact
The vulnerabilities addressed in this update are critical and could potentially allow attackers to compromise the automation platform, leading to unauthorized access, privilege escalation, or execution of arbitrary commands within the affected container environment. This could disrupt IT automation workflows and potentially impact the security of managed systems. However, no known exploits in the wild have been reported at this time.
Summary
Red Hat released a security advisory (RHSA-2026:71177) for Ansible Automation Platform 2.7 container images, providing fixes for a wide range of security vulnerabilities identified by multiple CVEs including CVE-2025-57847 and others. The advisory references numerous bug fixes and security patches that enhance the platform's security and stability. The update is critical and intended to mitigate various weaknesses such as improper access controls, command injection, and other vulnerabilities as indicated by the extensive CWE list. The vendor recommends applying this update after all prior relevant errata have been applied.
- CWE-276Incorrect Default Permissions (opens in a new tab)
Base weaknessLikelihood of exploit: MediumOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
During installation, installed file permissions are set to allow anyone to modify those files.
Architecture and Design · Operation
The architecture needs to access and modification attributes for files to only those users who actually require those actions.
Architecture and Design · Separation of Privilege
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Requirements
Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and Design
Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-166Improper Handling of Missing Special Element (opens in a new tab)
Base weakness
The product receives input from an upstream component, but it does not handle or incorrectly handles when an expected special element is missing.
Developers should anticipate that special elements will be removed in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #9OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Architecture and Design
If at all possible, use library calls rather than external processes to recreate the desired functionality.
Architecture and Design · Operation · Sandbox or Jail
Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
Architecture and Design · Attack Surface Reduction
For any data that will be used to generate a command to be executed, keep as much of that data out of external control as possible. For example, in web applications, this may require storing the data locally in the session's state instead of sending it out to the client in a hidden form field.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-807Reliance on Untrusted Inputs in a Security Decision (opens in a new tab)
Base weaknessLikelihood of exploit: HighOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
Architecture and Design · Attack Surface Reduction
Store state information and sensitive data on the server side only.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-407Inefficient Algorithmic Complexity (opens in a new tab)
Class weaknessLikelihood of exploit: Low
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1333Inefficient Regular Expression Complexity (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Architecture and Design
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
System Configuration
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Implementation
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-204Observable Response Discrepancy (opens in a new tab)
Base weakness
The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
Architecture and Design · Separation of Privilege
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Implementation
Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended).
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-862Missing Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #4OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries.
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-209Generation of Error Message Containing Sensitive Information (opens in a new tab)
Base weaknessLikelihood of exploit: HighOWASP Top 10 A10:2025: Mishandling of Exceptional Conditions (opens in a new tab)
The product generates an error message that includes sensitive information about its environment, users, or associated data.
Implementation
Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended).
Implementation
Handle exceptions internally and do not display errors containing potentially sensitive information to a user.
Implementation · Attack Surface Reduction
Use naming conventions and strong types to make it easier to spot when sensitive data is being used. When creating structures, objects, or other complex entities, separate the sensitive and non-sensitive data as much as possible.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (opens in a new tab)
Base weaknessOWASP Top 10 A05:2025: Injection (opens in a new tab)
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
Implementation · Parameterization
Where possible, avoid building a single string that contains the command and its arguments. Some languages or frameworks have functions that support specifying independent arguments, e.g. as an array, which is used to automatically perform the appropriate quoting or escaping while building the command.
Architecture and Design · Input Validation
Understand all the potential areas where untrusted inputs can enter your product: parameters or arguments, cookies, anything read from the network, environment variables, request headers as well as content, URL components, e-mail, files, databases, and any external systems that provide data to the application.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1050Excessive Platform Resource Consumption within a Loop (opens in a new tab)
Base weakness
The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-184Incomplete List of Disallowed Inputs (opens in a new tab)
Base weaknessOWASP Top 10 A03:2021: Injection (opens in a new tab)
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
Implementation · Input Validation
Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-94Improper Control of Generation of Code ('Code Injection') (opens in a new tab)
Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #10OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Architecture and Design · Refactoring
Refactor your program so that you do not have to dynamically generate code.
Architecture and Design
Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #6OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
- Attack patterns
- Path Traversal (opens in a new tab)
- Using Slashes and URL Encoding Combined to Bypass Validation Logic (opens in a new tab)
- Manipulating Web Input to File System Calls (opens in a new tab)
- Using Escaped Slashes in Alternate Encoding (opens in a new tab)
- Using Slashes in Alternate Encoding (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-140Improper Neutralization of Delimiters (opens in a new tab)
Base weakness
The product does not neutralize or incorrectly neutralizes delimiters.
Implementation · Input Validation
Developers should anticipate that delimiters will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Implementation · Output Encoding
While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments.
- OWASP Cheat Sheets
- OWASP ASVS 4.0.3
- Attack patterns
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-1289Improper Validation of Unsafe Equivalence in Input (opens in a new tab)
Base weakness
The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-489Active Debug Code (opens in a new tab)
Base weaknessOWASP Top 10 A02:2025: Security Misconfiguration (opens in a new tab)
The product is released with debugging code still enabled or active.
Build and Compilation · Distribution
Remove debug code before deploying the application.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-863Incorrect Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #17OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries.
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-639Authorization Bypass Through User-Controlled Key (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #24OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Architecture and Design · Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
- OWASP Cheat Sheets
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
- CWE-918Name not in the CWE catalogue (opens in a new tab)
- CWE-427Name not in the CWE catalogue (opens in a new tab)
- CWE-79Name not in the CWE catalogue (opens in a new tab)
- CWE-522Name not in the CWE catalogue (opens in a new tab)
- CWE-915Name not in the CWE catalogue (opens in a new tab)
- CWE-134Name not in the CWE catalogue (opens in a new tab)
- CWE-266Name not in the CWE catalogue (opens in a new tab)
- CWE-497Name not in the CWE catalogue (opens in a new tab)
- CWE-348Name not in the CWE catalogue (opens in a new tab)
- CWE-96Name not in the CWE catalogue (opens in a new tab)
- GCVE source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory ID
- RHSA-2026:71177
- Vendor Severity
- critical
- CVE Count
- 61
- Additional Cves
- CVE-2025-66418, CVE-2026-49825, CVE-2026-53488, CVE-2026-53492, CVE-2026-54284, CVE-2026-59893, CVE-2026-71458, CVE-2026-71459, CVE-2026-71460, CVE-2026-71461, CVE-2026-71462, CVE-2026-71463, CVE-2026-71464, CVE-2026-71465, CVE-2026-71491, CVE-2026-75884, CVE-2026-76218, CVE-2026-76219, CVE-2026-76220, CVE-2026-76221, CVE-2026-76222, CVE-2026-76648, CVE-2026-78679, CVE-2026-84292, CVE-2026-84394, CVE-2026-84470, CVE-2026-84474, CVE-2026-84475, CVE-2026-84486, CVE-2026-84499, CVE-2026-84502, CVE-2026-84638, CVE-2026-84643, CVE-2026-84644, CVE-2026-84678, CVE-2026-84680, CVE-2026-84683, CVE-2026-84684, CVE-2026-84686, CVE-2026-84689, CVE-2026-84691, CVE-2026-84692, CVE-2026-84703, CVE-2026-84706, CVE-2026-84707, CVE-2026-84708, CVE-2026-84709, CVE-2026-84711, CVE-2026-84712, CVE-2026-84713, CVE-2026-84714, CVE-2026-84716, CVE-2026-84717, CVE-2026-84718, CVE-2026-84719, CVE-2026-84720, CVE-2026-84721, CVE-2026-84724, CVE-2026-85475, CVE-2026-87817
References
- access.redhat.com/errata/RHSA-2026:71177 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2025-57847 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2025-66418 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-49825 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-53488 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-53492 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-54284 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-59893 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-71458 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-71459 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-71460 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-71461 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-71462 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-71463 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-71464 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-71465 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-71491 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-75884 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-76218 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-76219 (opens in a new tab)
Community reviews
Related threats
- Red Hat Security Advisory: RHOAI 2.25.12 - Red Hat OpenShift AICriticalVulnerability
- Red Hat Security Advisory: RHOAI 3.5.2 - Red Hat OpenShift AICriticalVulnerability
- Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.19.22 security, enhancement & bug fix updateHighVulnerability
- Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.20.17 security, enhancement & bug fix updateHighVulnerability
- Red Hat Security Advisory: Red Hat OpenShift API for Data ProtectionHighVulnerability