CVE-2026-84499 is a vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8 where the automation-controller improperly includes decrypted plaintext passwords in error messages during survey validation. A user with delegated JobTemplate Admin role can exploit this by tightening survey length constraints to trigger revalidation and recover stored passwords of higher-privileged users. This disclosure occurs in HTTP response error messages related to minimum/maximum length validation.
A flaw was found in Red Hat Ansible Automation Platform's automation-
controller. The Project scm_url field is not validated against values that
begin with a dash and is stored and passed verbatim to the git SCM module.
Because the module runs git ls-remote with the URL as a positional argument and
without a "--" separator, a git project URL such as "--upload-pack=<command>:x"
is interpreted by git as the --upload-pack option and executed via a shell. A
user with permission to create or modify a project in a single organization can
thereby execute arbitrary commands on the control-plane task pod, with output
reflected through the project update stdout endpoint, leading to cross-tenant
compromise and in-cluster lateral movement
A flaw was found in Red Hat Ansible Automation Platform's automation-
controller. The provisioning-callback secret (host_config_key) is exposed to
users holding only the read-level view_jobtemplate permission -- both in the
job template API representation and in the activity stream -- and the
provisioning callback endpoint trusts a client-supplied X-Forwarded-For
header to determine the calling host when the controller is deployed behind
the AAP gateway with an empty proxy allow-list. By reading the secret and
spoofing X-Forwarded-For to match any host in the job template's inventory, a
minimally privileged or unauthenticated remote attacker can launch the job
template against arbitrary managed hosts using the job template's credentials,
resulting in privilege escalation and remote code execution on managed hosts.
CVE-2026-84486 is a high-severity vulnerability in Red Hat Ansible Automation Platform 2.6 for RHEL 9. It involves active debug views in the automation-controller that are accessible to any user, including unauthenticated clients, due to missing gating on debug settings. An attacker can repeatedly invoke these endpoints to acquire a cluster-wide scheduler advisory lock, causing legitimate scheduler runs to be skipped and stalling job dispatch for all tenants. Additionally, the debug root view discloses the list of debug endpoints to unauthenticated users.
A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This may cause the plug-in to crash if the byte immediately following the pixel buffer is inaccessible; no information disclosure or code execution has been demonstrated.
CVE-2026-71465 is a low severity vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8 involving improper neutralization of argument delimiters in command construction. The RunAdHocCommand.build_args() method appends the limit parameter as a bare positional argument rather than using a proper option flag, allowing a limit value starting with '-' to be interpreted as an Ansible CLI option. Currently, this is limited to short-circuit flags like --version or --help, but could escalate if ansible-core changes default behavior. A security update is available in Red Hat Ansible Automation Platform 2.6. The vendor advisory provides detailed remediation guidance and lists this issue among multiple fixed vulnerabilities.
CVE-2026-71464 is a low severity vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8 involving improper neutralization of argument delimiters in the scm_branch parameter. The LaunchConfigurationBaseSerializer lacks a validate_scm_branch() leading-dash check, allowing potentially dangerous input such as --upload-pack=/bin/id. Although runtime checks currently block exploitation, the absence of API-level validation means that removal of these runtime guards could lead to remote code execution.
CVE-2026-71463 is a low severity vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8 where the notification template Jinja AST whitelist only inspects static Getattr nodes, allowing dynamic subscripts and conditional gating to bypass checks. This results in full tracebacks being included in notification bodies sent to attacker-controlled webhook URLs, leaking sensitive information such as install paths, Python version, and source line numbers.
An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in.
CVE-2026-71462 is a vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8 where the StringListPathField.to_internal_value() function calls os.path.exists() on unbounded user-supplied paths. This behavior allows a tenant superuser to confirm the existence of arbitrary absolute paths on the controller-web pod by observing different HTTP response codes (200 vs 400). This can expose sensitive files such as /etc/tower/SECRET_KEY, Kubernetes service-account tokens, receptor sockets, and ConfigMap mount points. The issue is mainly impactful in managed Ansible Automation Platform environments where tenant administrators do not have host administrator privileges.
CVE-2026-71461 is a vulnerability in Red Hat Ansible Automation Platform 2.7 where error messages generated by the HostList.list() function expose sensitive internal information. Authenticated users can trigger exceptions that leak the complete Host model relation graph or raw database error strings through crafted inputs, potentially revealing internal schema details.
CVE-2026-71460 is a medium severity vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8 where the /api/v2/config/ endpoint is protected only by authentication but lacks proper authorization. This allows any authenticated user to access license information including account number, subscription ID, pool ID, SKU, support level, and instance counts. The vulnerability does not affect confidentiality or integrity beyond license data disclosure and does not allow privilege escalation or code execution. It enables potential social engineering and reconnaissance against Red Hat support and customer estate sizing. A vendor advisory is available but does not explicitly confirm patch status for this specific CVE. The CVSS 3.1 base score is 4.3 (medium).
CVE-2026-76648 is a high-severity vulnerability in Red Hat Ansible Automation Platform 2.7 involving missing authorization checks in the CopyAPIView. The POST method lacks proper object-level read permission validation, allowing users with certain roles to copy JobTemplate objects without having read access to the source. This could lead to unauthorized information disclosure. Red Hat has released an update to address this issue.
CVE-2026-88840 is a medium severity vulnerability in Red Hat Hardened Images involving an out-of-bounds read in BusyBox's TLS get_client_hello() function. The flaw occurs when parsing a truncated ClientHello message, causing the function to read past the end of the input buffer. This vulnerability does not impact confidentiality, integrity, or availability beyond a limited information disclosure risk. No known exploits are reported in the wild. No specific affected versions are stated in the available data.
CVE-2026-88839 is an out-of-bounds write vulnerability in the BusyBox passwd/group tokenize() function within Red Hat Hardened Images. It occurs due to referencing a stale endpoint pointer after trimming, leading to an out-of-bounds write of heap pointers. This vulnerability has a CVSS score of 6.7, indicating a medium severity with high impact on confidentiality, integrity, and availability. Red Hat has released an update to BusyBox packages that addresses this issue.
CVE-2026-88837 is a vulnerability in BusyBox httpd used in Red Hat Hardened Images where yescrypt ($y$) password hashes are incorrectly treated as plaintext during Basic Authentication, causing an inversion of the authentication check. This flaw can lead to authentication bypass. Red Hat has released an update to BusyBox packages to address this issue.
CVE-2026-88835 is an out-of-bounds heap read vulnerability in BusyBox's dpkg read_package_field() function within Red Hat Hardened Images. It occurs when processing malformed .deb packages that cause the function to read past a NUL terminator. This vulnerability has a medium severity with a CVSS score of 6.1 and impacts confidentiality and availability. Red Hat has issued an update for BusyBox packages to address this issue.
A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is closed.
CVE-2026-71459 is a medium severity vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8 where a specific view (JobJobEventsChildrenSummary) lacks proper authorization checks. This allows any authenticated user, including those with zero privileges, to read event tree structures, event processing status, and enumerate job IDs across the platform. The vulnerability arises because the view does not implement object-level permission checks and improperly falls through permission validation. A related endpoint correctly enforces access controls. A security advisory from Red Hat is available with further details.