Threats tagged 'cleanstart-2026-kk99760'

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-eda-controller: Template Injection via Git Branch and Refspec in EDA Projects (CVE-2025-49521) * automation-eda-controller: Authenticated Argument Injection in Git URL in EDA Project Creation (CVE-2025-49520) * automation-gateway-proxy: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) * automation-gateway-proxy-openssl30: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) * automation-gateway-proxy-openssl32: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) * receptor: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Updates and fixes included: Automation Platform * Updated API error messaging to be more helpful in the event a user logs in as the admin user via legacy auth on one component, then tries to do so via the other component (AAP-47541) * Fixed an issue where API records could be missing or duplicated across pages (AAP-47504) * Refactored V1RootView.get() and improve reverse lookup logic (AAP-47366) * Refactored process_statuses() method to reduce its cognitive complexity (AAP-47341) * Improved accuracy of openapi API docs and schema (AAP-46639) * Reduced the cognitive complexity of method migrate_resource() in migrate_service_data.py from 56 to <=15 (AAP-45822) * Reduced the cognitive complexity of the process_fields() method in serializers/preference.py file (AAP-45820) * Reduced the cognitive complexity of unique_fields_for_model() method to below 15 (AAP-45819) * Enable query filtering for fields user_ansible_id, team_ansible_id, and object_ansible_id on the role assignment API endpoints (AAP-45443) * The Survey form is displayed for a Worlflow visualizer Job template or Workflow Job template node with a survey enabled and no Prompt on Launch fields (AAP-47732) * Fixed a bug that was causing the UI to throw an error when launching a workflow job template with both "Prompt on Launch" and "Survey" enabled (AAP-47668) * The API feature flags used to hide references to Policy as Code in the UI have been removed. All Policy as Code fields appear for all users at all times (AAP-47006) * Fixed a bug that was causing the UI to throw an error when launching a workflow job template with both "Prompt on Launch" and "Survey" enabled (AAP-46813) * On the inventory source form, for a source type of 'VMware ESXi' the user will be able to select credentials of type 'VMware vCenter' (AAP-46784) * Fixed a bug when selecting the 'Comparison' field for Atrriibute trigger in the Authenticator Map form (AAP-46555) * Fixed a bug that was causing the UI to throw an error when launching a workflow job template with both "Prompt on Launch" and "Survey" enabled (AAP-45834) * added an extra validation to handle incorrect user input in the variables field, as the API doesn't return an error for it (AAP-42563) * Fixed a bug that was causing the UI to throw an error when launching a workflow job template with both "Prompt on Launch" and "Survey" enabled (AAP-42303) * The Hosts links in the Resource Counts section of the overview page were fixed to redirect to the Hosts page (AAP-42288) * Allows role assignments using object_ansible_id in the role_user_assignment module (AAP-48042) * Improved documentation and examples related to object_id and object_ansible_id parameters in role_user_assignment module (AAP-48041) * Allows object_id field in role_user_assignment module to accept a list of items (AAP-47979) * Fixed an example task in ansible.platform.token module (AAP-47976) * Specify correct aap_* parameters in ansible.platform.token module (AAP-47975) * Improved documentation and examples for authenticator and authenticator_map modules (AAP-45982) * Updated documentation examples for the ansible.platform.settings module with tested tasks examples (AAP-45954) * Added a new section in the collection README describing how to authenticate to AAP from the playbook (AAP-45578) * Ensures that modules in the ansible.platform collection accepts AAP_* variable for authentication (AAP-45363) * Fixed ansible.platform.user not adding users to organizations (AAP-45248) * Allows running ansible.platform collection modules in check_mode (AAP-45246) * Ad