GHSA-JXRP-R7GX-Q4J8 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, wazuh-dashboard, kibana, librechat, langfuse, opensearch-dashboards, gitlab-rails-ce, awx, wazuh-dashboard-fips, langfuse-fips, gitlab-rails-ce-fips, nextcloud-server...

CVE-2026-66010 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, wazuh-dashboard, kibana, librechat, langfuse, opensearch-dashboards, gitlab-rails-ce, awx, wazuh-dashboard-fips, langfuse-fips, gitlab-rails-ce-fips, nextcloud-server...

MAL-015

MAL-015: Ansible Tower의 격리 탈출 2Isolation Escape 2 특정 Rhel 7/8 구성의 Ansible Tower 설치 환경은 공격자가 격리된 환경 외부에서 'awx' 사용자로 권한을 상승시킬 수 있게 하는 '작업 격리Job Isolation' 탈출에 취약할 수 있습니다. CVE-2021-20253이 패치된 후 작업 격리 탈출 취약점을 수행하기 위해 공격자가 악용할 수 있는 파일/구성은 다음과 같습니다: "/var/spool/mail/awx" 파일: 대상에 SMTP 서버가 설치되어 있는 경우 공격자...

CVE-2021-20253

CVE-2021-20253: Ansible Tower의 Job Isolation 탈출을 통한 권한 상승 ansible-tower에서 결함이 발견되었습니다. 기본 설치는 Job Isolation 탈출에 취약하여 공격자가 격리된 환경 외부에서 낮은 권한의 사용자에서 awx 사용자로 권한을 상승시킬 수 있습니다. 이 취약성으로 인한 가장 큰 위협은 데이터 기밀성과 무결성, 그리고 시스템 가용성입니다. 공급업체 공개: 이 취약성에 대한 공급업체의 공개 및 수정 사항은 여기에서 확인할 수 있습니다. 요구 사항: 이 취약성을 악용하려면...

awx: awx: Privilege escalation to OpenShift namespace via pod_spec_override injection in container groups

A flaw was found in AWX. The container group podspecoverride field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can...

automation-controller: automation-controller-container: automation-controller/AWX: Bulk Job Launch checks instance_groups at read level instead of use level, allowing execution-placement authorization bypass

A flaw was found in Ansible Automation Platform's automation-controller AWX. The Bulk Job Launch API POST /api/v2/bulk/joblaunch/ authorizes the requested instancegroups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same...

automation-controller: automation-controller: SystemJob extra_vars.days argument injection into uncontainerized control-plane awx-manage process

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...

automation-controller: automation-controller: SystemJob extra_vars.days argument injection into uncontainerized control-plane awx-manage process

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...

awx: awx: Privilege escalation to OpenShift namespace via pod_spec_override injection in container groups

A flaw was found in AWX. The container group podspecoverride field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can...

awx: awx: Privilege escalation to OpenShift namespace via pod_spec_override injection in container groups

A flaw was found in AWX. The container group podspecoverride field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can...

CVE-2026-84724

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...

CVE-2026-75884

A flaw was found in AWX. The container group podspecoverride field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can...

CVE-2026-84724 Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...

CVE-2026-84724

An argument-injection flaw exists in the Ansible Automation Platform automation-controller system-job subsystem. The issue occurs because the system-job template launch endpoint fails to perform integer validation on a user-supplied "days" variable . Consequently, the dispatcher flattens the mana...

CVE-2026-84724 Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...

CVE-2026-75884 Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups

A flaw was found in AWX. The container group podspecoverride field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can...

EUVD-2026-85639

A flaw was found in AWX. The container group podspecoverride field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can...

CVE-2026-75884 Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups

A flaw was found in AWX. The container group podspecoverride field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can...

CVE-2026-75884

A flaw in AWX allows an AAP platform administrator to escalate privileges to OpenShift namespace-level access and exfiltrate namespace secrets . The vulnerability exists because the pod_spec_override field in the container group uses an incomplete blocklist that only restricts automountServiceAcc...

CVE-2026-75884

A flaw was found in AWX. The container group podspecoverride field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can...