VolSync v0.16 is a Kubernetes operator that enables asynchronous
replication of persistent volumes within a cluster, or across clusters. After
deploying the VolSync operator, it can create and maintain copies of your
persistent data.
For more information about VolSync, see:
https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/business_continuity/business-cont-overview#volsync
See the VolSync open source community website at: https://volsync.readthedocs.io/en/stable/.
A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send requests to the in-cluster catalogd service, leading to the disclosure of the internal operator-catalog index and providing a relay into the openshift-catalogd namespace.
CVE-2026-84724 is an argument injection vulnerability in the system-job subsystem of Red Hat Ansible Automation Platform 2.5 for RHEL 8. The flaw arises because the system-job template launch endpoint accepts a user-supplied "days" variable without proper integer validation, allowing spaces in the value to be interpreted as additional command-line arguments. Since system jobs run in-process on the control node without container isolation, an authenticated user with superuser privileges can inject arbitrary arguments into the awx-manage process, influencing its argument vector and module search path. Although full remote code execution requires an additional import gadget not currently present, the vulnerability enables argument injection with control over the process search path. A security update addressing this and other issues is available for Red Hat Ansible Automation Platform 2.6. The CVSS v3.1 base score is 6.6 (medium severity).
CVE-2026-84721 is a server-side request forgery (SSRF) vulnerability in the email notification backend of Red Hat Ansible Automation Platform 2.7. It allows an authenticated user with notification-admin permissions to craft email notification templates that cause the controller to open TCP connections to arbitrary internal addresses without proper validation. This can be used to perform internal port scanning and potentially leak SMTP credentials if stored in the template. A fix is available from Red Hat.
CVE-2026-84720 is a vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8 where a database column used in workflow job nodes is not properly protected from arbitrary field lookups via the REST API. This allows users with limited read access or any authenticated user to infer secret values marked as no_log by exploiting a boolean/count oracle. The flaw arises because the ancestor_artifacts column is not wrapped in a search-prevention mechanism and is persisted before masking is applied.
CVE-2026-84718 is a medium severity vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8 where the automation-controller trusts the client-supplied X-Forwarded-For header without verifying it originated from a trusted proxy. This allows an attacker to forge the source IP address recorded in audit and access logs, undermining the integrity of forensic and SIEM attribution. The flaw does not grant additional access or privileges.
CVE-2026-84717 is a medium severity vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8. It involves an unauthenticated Bitbucket Data Center webhook receiver in the automation-controller that skips HMAC signature verification for diagnostics:ping events after template lookup. This causes the endpoint to return HTTP 200 for templates with Bitbucket DC webhooks configured and HTTP 403 otherwise, allowing an unauthenticated attacker to enumerate which Job Template and Workflow Job Template IDs have Bitbucket DC webhooks configured without knowing the secret webhook key.
CVE-2026-84716 is a vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8 involving incorrect privilege assignment in the automation-controller's install-bundle endpoint. It allows a system administrator to obtain a long-lived, non-revocable mesh peer certificate by registering a case-variant hostname, potentially enabling TLS impersonation or interception of control mesh nodes. The vulnerability does not allow direct remote code execution. A security update addressing this and other issues is available.
CVE-2026-84713 is a vulnerability in Red Hat Ansible Automation Platform 2.7's automation-controller notification subsystem. It allows an authenticated user with no privileges to recover secret recipient values from other tenants' notifications by exploiting insufficient authorization checks in API filtering. This leads to unauthorized disclosure of sensitive information such as PagerDuty service keys and webhook bearer tokens. The vulnerability affects confidentiality but does not impact integrity or availability.
CVE-2026-84712 is a medium-severity vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8. It involves an unauthenticated health-check API endpoint that over-serializes role-based access control (RBAC) gated automation mesh data, exposing detailed instance inventory and control plane information. The exposure includes node hostnames, types, UUIDs, heartbeats, capacities, versions, instance-group names and membership, deployment install UUID, and the active control node. This information disclosure affects confidentiality but does not expose secrets, credentials, or tenant data.
A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.
CVE-2026-85475 is a high-severity vulnerability in Red Hat Ansible Automation Platform 2.7 where user-controlled settings are improperly neutralized in the rsyslog configuration. This flaw allows a privileged user to inject rsyslog directives, leading to arbitrary command execution within the control-plane rsyslog component. Exploitation can result in disclosure of sensitive secrets, including the controller SECRET_KEY and database credentials, enabling full compromise of the control plane. Red Hat has released an official update to address this issue.
A flaw was found in the Ansible Automation Platform automation-controller. When a
WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory,
unified_job_template, and credentials of each cloned node and fails to check the instance_groups
(and execution_environment and labels) that were preserved from the original. A user with
organization workflow-admin permission but no role on the referenced instance groups can copy a
workflow, become its administrator, and launch jobs pinned to instance groups they are not
authorized to use — including the control-plane instance group — bypassing the InstanceGroup
use_role boundary and causing attacker-influenced automation to run in the control-plane
execution context.
CVE-2026-84714 is a vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8 where the input-validation function sanitize_jinja() inadequately filters user-supplied Jinja expressions. This allows low-privileged users to inject Jinja code that is evaluated by ansible-core, potentially enabling arbitrary command execution and unauthorized disclosure of credential secrets. The flaw arises because the regex patterns used to block disallowed inputs stop prematurely, allowing nested braces in Jinja expressions to bypass the filter. This vulnerability affects launch-time fields such as ad-hoc command module_args and credential usernames. A security advisory from Red Hat confirms the issue and provides an update for Red Hat Ansible Automation Platform 2.6 addressing this and other vulnerabilities.
CVE-2026-84706 is a high-severity vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8. It involves an incomplete deny-list of environment variables in the automation-controller's custom Credential Type environment-variable injector. This flaw allows a privileged user to inject attacker-controlled scripts via environment variables such as BASH_ENV, leading to arbitrary code execution within the execution-environment container for jobs using the affected credential type.
A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can exploit this to escalate privileges to OpenShift namespace-level access and exfiltrate namespace secrets.
CVE-2026-84691 is a high-severity vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8. It involves an externally-controlled Python format string used in logging API 4XX errors. An authenticated administrator can craft a malicious format string that accesses sensitive application settings, including the Django secret key and database password. These secrets are logged and can be forwarded to external log aggregators, potentially exposing critical credentials. This exposure enables offline decryption of stored credentials, session forgery, and direct database access.
CVE-2026-84683 is a stored cross-site scripting (XSS) vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8. The issue arises because the HTML view of job outputs escapes HTML metacharacters but does not remove ANSI terminal escape sequences before converting to HTML. This allows an attacker with low privileges to embed a malicious javascript: link in output that is rendered without Content-Security-Policy. When a higher-privileged user clicks the link, attacker-controlled JavaScript executes in their session, potentially leading to full platform takeover.