Search: CVE-2026-90959

CVE-2026-90959 is a path traversal vulnerability in the pulpcore component of Red Hat Ansible Automation Platform 2.6 for RHEL 9. The vulnerability arises from improper validation of the 'file_url' parameter in the content upload API, allowing authenticated users with low repository privileges to read arbitrary files on the server. In environments using Pulp Container, exploitation can lead to theft of the container registry token signing private key, enabling unauthorized access to private container repositories. Red Hat has released an update addressing this issue.