Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in

RHEL 10 / 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Important) (RHSA-2026:59136)

🗓️ 25 Aug 2026 00:00:00Reported by TenableType 
nessus
 nessus🔗 www.tenable.com👁 5 Views

Multiple CVEs in Red Hat Ansible Automation Platform 2.6: SSRF, path traversal, DoS, code execution.

Related
Refs
Code
ReporterTitlePublishedViews
Family
ibm
IBM Security Bulletins		Security Bulletin: Multiple Vulnerabilities in IBM API Connect
21 Aug 202617:10
–ibm
ibm
IBM Security Bulletins		Security Bulletin: Vulnerability in node.js affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.
25 Aug 202618:22
–ibm
ibm
IBM Security Bulletins		Security Bulletin: IBM Security SOAR is using a component with a known vulnerability (CVE-2026-12143)
24 Jul 202616:33
–ibm
ibm
IBM Security Bulletins		Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.
3 Aug 202611:18
–ibm
ibm
IBM Security Bulletins		Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities
29 Jun 202612:20
–ibm
ibm
IBM Security Bulletins		Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in JavaScript
13 Jul 202608:36
–ibm
ibm
IBM Security Bulletins		Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in JavaScript
13 Jul 202608:36
–ibm
ibm
IBM Security Bulletins		Security Bulletin: form-data CRLF Injection via Unescaped Field Name and Filename
7 Aug 202610:54
–ibm
ibm
IBM Security Bulletins		Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.
30 Jul 202615:32
–ibm
ibm
IBM Security Bulletins		Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in form-data and DOMPurify
21 Jul 202605:20
–ibm
Rows per page
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory RHSA-2026:59136. The text
# itself is copyright (C) Red Hat, Inc.
##

include('compat.inc');

if (description)
{
  script_id(339179);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/25");

  script_cve_id(
    "CVE-2026-12143",
    "CVE-2026-15307",
    "CVE-2026-34993",
    "CVE-2026-39373",
    "CVE-2026-44545",
    "CVE-2026-44705",
    "CVE-2026-52902",
    "CVE-2026-59886",
    "CVE-2026-67322",
    "CVE-2026-67323",
    "CVE-2026-67324",
    "CVE-2026-67325",
    "CVE-2026-69243",
    "CVE-2026-69244",
    "CVE-2026-71364",
    "CVE-2026-71365",
    "CVE-2026-71366",
    "CVE-2026-73620"
  );
  script_xref(name:"RHSA", value:"2026:59136");

  script_name(english:"RHEL 10 / 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Important) (RHSA-2026:59136)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Red Hat host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as
referenced in the RHSA-2026:59136 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing
    IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to
    individual teams, while automation developers retain the freedom to write tasks that leverage existing
    knowledge without the overhead. Ansible Automation Platform makes it possible for users across an
    organization to share, vet, and manage automation content by means of a simple, powerful, and agentless
    language.

    Security Fix(es):

    * automation-controller: notification backends allow SSRF and credential leakage (CVE-2026-71366)
    * automation-controller: webhook status callback SSRF leaks the Git PAT (CVE-2026-71365)
    * automation-controller: project archive extraction allows path traversal file writes (CVE-2026-71364)
    * automation-controller: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade (CVE-2026-69243)
    * automation-controller: AIOHTTP: Denial of Service via malformed HTTP responses (CVE-2026-69244)
    * automation-controller: pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59886)
    * automation-controller: path traversal via YAML !include directive (CVE-2026-52902)
    * automation-controller: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()
    (CVE-2026-34993)
    * automation-controller: daphne: Denial of Service via excessive WebSocket message size (CVE-2026-44545)
    * automation-controller: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373)
    * automation-platform-ui: form-data: Form field override via CRLF injection (CVE-2026-12143)
    * automation-platform-ui: path Traversal via unsanitized prefix/postfix enables directory escape
    (CVE-2026-44705)
    * python-django: Remote code execution via GeoDjango spatial lookups (CVE-2026-15307)
    * python3.12-aiohttp: HTTP Request Smuggling via WebSocket Upgrade (CVE-2026-69243)
    * python3.12-aiohttp: Denial of Service via malformed HTTP responses (CVE-2026-69244)
    * python3.12-django: Remote code execution via GeoDjango spatial lookups (CVE-2026-15307)
    * python3.12-gitpython: Command Injection via Git option prefix abbreviation (CVE-2026-67325)
    * python3.12-gitpython: Arbitrary Code Execution via Joined Short Options Bypass (CVE-2026-67324)
    * python3.12-gitpython: Arbitrary code execution via command injection due to unguarded Git options
    (CVE-2026-67323)
    * python3.12-gitpython: Environment variable exfiltration via attacker-controlled clone URL
    (CVE-2026-67322)
    * python3.12-gitpython: Arbitrary file overwrite and read via unsafe git option forwarding
    (CVE-2026-73620)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and
    other related information, refer to the CVE page(s) listed in the References section.

    For details about this release, refer to the release notes listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/updates/classification/#important");
  # https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2242e607");
  # https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?89e9dbff");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2456187");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2484099");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2484377");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2486729");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2487946");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2488480");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2500041");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2509975");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2509976");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2510021");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2510032");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2510825");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2510831");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2511095");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2511900");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2511901");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2511902");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2515261");
  # https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59136.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0367a056");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2026:59136");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-44705");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-67324");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(22, 78, 88, 93, 125, 214, 434, 444, 502, 770, 918);
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/25");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:10");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:9");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:automation-controller-cli");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:automation-controller-venv-tower");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:automation-platform-ui");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-django");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python3-django");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python3.12-aiohttp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python3.12-django");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python3.12-gitpython");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Red Hat Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl", "redhat_repos.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');
include('rhel.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'Red Hat' >!< os_product) audit(AUDIT_OS_NOT, 'Red Hat');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');
if (!rhel_check_release_list(operator: 'ge', os_version: os_version, rhel_versions: ['10','9'])) audit(AUDIT_OS_NOT, 'Red Hat 10.x / 9.x', 'Red Hat ' + os_version);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);

var constraints = [
  {
    'release': '10',
    'repo_relative_urls': [
      'content/dist/layered/rhel10/aarch64/ansible-automation-platform/2.6/debug',
      'content/dist/layered/rhel10/aarch64/ansible-automation-platform/2.6/os',
      'content/dist/layered/rhel10/aarch64/ansible-automation-platform/2.6/source/SRPMS',
      'content/dist/layered/rhel10/aarch64/ansible-developer/1.3/debug',
      'content/dist/layered/rhel10/aarch64/ansible-developer/1.3/os',
      'content/dist/layered/rhel10/aarch64/ansible-developer/1.3/source/SRPMS',
      'content/dist/layered/rhel10/ppc64le/ansible-automation-platform/2.6/debug',
      'content/dist/layered/rhel10/ppc64le/ansible-automation-platform/2.6/os',
      'content/dist/layered/rhel10/ppc64le/ansible-automation-platform/2.6/source/SRPMS',
      'content/dist/layered/rhel10/ppc64le/ansible-developer/1.3/debug',
      'content/dist/layered/rhel10/ppc64le/ansible-developer/1.3/os',
      'content/dist/layered/rhel10/ppc64le/ansible-developer/1.3/source/SRPMS',
      'content/dist/layered/rhel10/s390x/ansible-automation-platform/2.6/debug',
      'content/dist/layered/rhel10/s390x/ansible-automation-platform/2.6/os',
      'content/dist/layered/rhel10/s390x/ansible-automation-platform/2.6/source/SRPMS',
      'content/dist/layered/rhel10/s390x/ansible-developer/1.3/debug',
      'content/dist/layered/rhel10/s390x/ansible-developer/1.3/os',
      'content/dist/layered/rhel10/s390x/ansible-developer/1.3/source/SRPMS',
      'content/dist/layered/rhel10/x86_64/ansible-automation-platform/2.6/debug',
      'content/dist/layered/rhel10/x86_64/ansible-automation-platform/2.6/os',
      'content/dist/layered/rhel10/x86_64/ansible-automation-platform/2.6/source/SRPMS',
      'content/dist/layered/rhel10/x86_64/ansible-developer/1.3/debug',
      'content/dist/layered/rhel10/x86_64/ansible-developer/1.3/os',
      'content/dist/layered/rhel10/x86_64/ansible-developer/1.3/source/SRPMS'
    ],
    'pkgs': [
      {'reference':'python3-django-5.2.17-1.el10ap', 'el_string':'el10ap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'automation-hub-2.6', 'cves':['CVE-2026-15307']}
    ]
  },
  {
    'release': '9',
    'repo_relative_urls': [
      'content/dist/layered/rhel9/aarch64/ansible-automation-platform/2.6/debug',
      'content/dist/layered/rhel9/aarch64/ansible-automation-platform/2.6/os',
      'content/dist/layered/rhel9/aarch64/ansible-automation-platform/2.6/source/SRPMS',
      'content/dist/layered/rhel9/aarch64/ansible-developer/1.3/debug',
      'content/dist/layered/rhel9/aarch64/ansible-developer/1.3/os',
      'content/dist/layered/rhel9/aarch64/ansible-developer/1.3/source/SRPMS',
      'content/dist/layered/rhel9/ppc64le/ansible-automation-platform/2.6/debug',
      'content/dist/layered/rhel9/ppc64le/ansible-automation-platform/2.6/os',
      'content/dist/layered/rhel9/ppc64le/ansible-automation-platform/2.6/source/SRPMS',
      'content/dist/layered/rhel9/ppc64le/ansible-developer/1.3/debug',
      'content/dist/layered/rhel9/ppc64le/ansible-developer/1.3/os',
      'content/dist/layered/rhel9/ppc64le/ansible-developer/1.3/source/SRPMS',
      'content/dist/layered/rhel9/s390x/ansible-automation-platform/2.6/debug',
      'content/dist/layered/rhel9/s390x/ansible-automation-platform/2.6/os',
      'content/dist/layered/rhel9/s390x/ansible-automation-platform/2.6/source/SRPMS',
      'content/dist/layered/rhel9/s390x/ansible-developer/1.3/debug',
      'content/dist/layered/rhel9/s390x/ansible-developer/1.3/os',
      'content/dist/layered/rhel9/s390x/ansible-developer/1.3/source/SRPMS',
      'content/dist/layered/rhel9/x86_64/ansible-automation-platform/2.6/debug',
      'content/dist/layered/rhel9/x86_64/ansible-automation-platform/2.6/os',
      'content/dist/layered/rhel9/x86_64/ansible-automation-platform/2.6/source/SRPMS',
      'content/dist/layered/rhel9/x86_64/ansible-developer/1.3/debug',
      'content/dist/layered/rhel9/x86_64/ansible-developer/1.3/os',
      'content/dist/layered/rhel9/x86_64/ansible-developer/1.3/source/SRPMS'
    ],
    'pkgs': [
      {'reference':'automation-controller-cli-4.7.16-1.el9ap', 'el_string':'el9ap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'automation-hub-2.6', 'cves':['CVE-2026-52902']},
      {'reference':'python3.12-django-5.2.17-1.el9ap', 'el_string':'el9ap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'automation-hub-2.6', 'cves':['CVE-2026-15307']}
    ]
  },
  {
    'release': '9',
    'repo_relative_urls': [
      'content/dist/layered/rhel9/aarch64/ansible-automation-platform/2.6/debug',
      'content/dist/layered/rhel9/aarch64/ansible-automation-platform/2.6/os',
      'content/dist/layered/rhel9/aarch64/ansible-automation-platform/2.6/source/SRPMS',
      'content/dist/layered/rhel9/ppc64le/ansible-automation-platform/2.6/debug',
      'content/dist/layered/rhel9/ppc64le/ansible-automation-platform/2.6/os',
      'content/dist/layered/rhel9/ppc64le/ansible-automation-platform/2.6/source/SRPMS',
      'content/dist/layered/rhel9/s390x/ansible-automation-platform/2.6/debug',
      'content/dist/layered/rhel9/s390x/ansible-automation-platform/2.6/os',
      'content/dist/layered/rhel9/s390x/ansible-automation-platform/2.6/source/SRPMS',
      'content/dist/layered/rhel9/x86_64/ansible-automation-platform/2.6/debug',
      'content/dist/layered/rhel9/x86_64/ansible-automation-platform/2.6/os',
      'content/dist/layered/rhel9/x86_64/ansible-automation-platform/2.6/source/SRPMS'
    ],
    'pkgs': [
      {'reference':'automation-controller-venv-tower-4.7.16-1.el9ap', 'el_string':'el9ap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'automation-hub-2.6', 'cves':['CVE-2026-34993', 'CVE-2026-39373', 'CVE-2026-44545', 'CVE-2026-59886', 'CVE-2026-69243', 'CVE-2026-69244', 'CVE-2026-71364', 'CVE-2026-71365', 'CVE-2026-71366']},
      {'reference':'automation-platform-ui-2.6.13-1.el9ap', 'el_string':'el9ap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'automation-hub-2.6', 'cves':['CVE-2026-12143', 'CVE-2026-44705']},
      {'reference':'python3.12-aiohttp-3.14.3-1.el9ap', 'el_string':'el9ap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'automation-hub-2.6', 'cves':['CVE-2026-69243', 'CVE-2026-69244']},
      {'reference':'python3.12-gitpython-3.1.59-1.el9ap', 'el_string':'el9ap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'automation-hub-2.6', 'cves':['CVE-2026-67322', 'CVE-2026-67323', 'CVE-2026-67324', 'CVE-2026-67325', 'CVE-2026-73620']}
    ]
  }
];

var applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);
if(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var repo_relative_urls;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }

  if (!empty_or_null(constraint['repo_relative_urls'])) repo_relative_urls = constraint['repo_relative_urls'];

  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&
        (applicable_repo_urls || (!exists_check || rpm_exists(rpm:exists_check))) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  var extra = NULL;
  if (isnull(applicable_repo_urls) || !applicable_repo_urls) extra = rpm_report_get() + redhat_report_repo_caveat();
  else extra = rpm_report_get();
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : extra
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'automation-controller-cli / automation-controller-venv-tower / etc');
}

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
25 Aug 2026 00:00Current
7.9High risk
Vulners AI Score7.9
CVSS 3.18.2 - 9.8
CVSS 49.3
EPSS0.01449
SSVC
Red Hat AnsibleSSRFpath traversaldenial of servicecode executioncredential leakageHTTP Request Smuggling
5