automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (AllowAny, routed without DEBUG guard) allow advisory-lock starvation of job dispatch (DoS)

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views that trigger the internal task, dependency, and workflow schedulers are configured to allow any user including unauthenticated clients and are routed in production builds because their URL include i...

automation-controller-container: automation-controller: automation-controller: server-side request forgery via the Thycotic Secret Server external credential plugin test endpoint (caller-controlled server_url, backend executed in the controller web process)

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Thycotic Secret Server external credential plugin passes a user-supplied server URL to its SDK without validating the scheme, host, or IP range, and the plugin backend is executed synchronously within the...

automation-controller: automation-controller-container: automation-controller: instance group attachment to schedules and workflow job template nodes checks only read permission, allowing use of restricted (controlplane / other-tenant) instance groups and privilege escalation to control-plane code execution

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching an instance group to a schedule or a workflow job template node through the dedicated API relationship endpoint, the controller verifies only that the requesting user can read view the instance group,...

automation-controller: automation-controller: CredentialType injector validation renders attacker-supplied Jinja2 templates synchronously in the web worker, allowing uncontrolled resource consumption (denial of service) and an unhandled-exception (500) via /api/controller/v2/credential_types/

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When a custom credential type is created or updated, the injector configuration is validated by rendering each attacker-supplied Jinja2 template synchronously inside the web request worker, with no limit on iteration...

automation-controller: automation-controller-container: automation-controller: execution environment credential foreign key is not use-permission checked, allowing an organization execution-environment admin to bind and disclose another organization's container registry credential (cross-tenant credential disclosure)

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When creating or editing an execution environment, the controller does not verify that the requesting user has use permission on the container registry credential referenced by the execution environment; it validates...

automation-controller: automation-controller: Project scm_branch/scm_refspec argument injection into git during project sync allows arbitrary file read on the sync host (control-plane ServiceAccount token, SECRET_KEY, and DB credentials on control-plane deployments) leading to full AAP and Kubernetes-namespace compromise

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The Project SCM branch and SCM refspec fields are accepted without rejecting values that begin with a dash and are passed to the git module during project synchronization, where they reach a git checkout/git fetch...

automation-controller: automation-controller-container: automation-controller/AWX: Bulk Job Launch checks instance_groups at read level instead of use level, allowing execution-placement authorization bypass

A flaw was found in Ansible Automation Platform's automation-controller AWX. The Bulk Job Launch API POST /api/v2/bulk/joblaunch/ authorizes the requested instancegroups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same...

automation-controller: automation-controller-container: automation-controller: missing use_role authorization on the project signature validation credential foreign key allows a project administrator to bind and use another organization's credential cross-tenant

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. A project has a signature validation credential foreign key used to validate signed project content. Unlike the project's SCM credential, the authorization logic does not verify that the requesting user has use...

automation-controller: automation-controller-container: automation-controller: organization galaxy credential attachment checks only read permission on the credential, allowing an organization admin with read-only visibility to bind and server-side-use another tenant's Automation Hub API token

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching a Galaxy or Automation Hub credential to an organization through the galaxycredentials relationship endpoint, the controller verifies only that the requesting user can read the credential, rather than...

automation-controller: automation-controller-container: automation-controller: format string injection in the API 4XX error log setting discloses Django SECRET_KEY and database credentials to an administrator

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors is an administrator-controlled Python format-string template that is rendered with a live user object as an argument. Because Python string...

automation-controller: automation-controller-container: automation-controller: container group pod_spec_override mints the automation-controller ServiceAccount token and mounts control-plane namespace secrets into job pods, bypassing automountServiceAccountToken:false (control-plane secret and identity compromise)

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. A user with the delegated Instance Group Admin role on a container group can set a free-form pod specification override that is deep-merged, without filtering, into every job pod launched on that group. The only...

Critical: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.6 Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and X-Forwarded-For spoofing of provisioning-callback host match

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret hostconfigkey is exposed to users holding only the read-level viewjobtemplate permission -- both in the job template API representation and in the activity stream -- and the...

automation-controller: automation-controller: WorkflowJobTemplate /copy/ deep-copy sanitizer omits instance_groups authorization (InstanceGroup use_role bypass to control-plane)

A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unifiedjobtemplate, and credentials of each cloned node and fails to check the instancegroups and executionenvironment...

automation-controller: automation-controller: SystemJob extra_vars.days argument injection into uncontainerized control-plane awx-manage process

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...

Critical: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.4 Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

automation-controller: automation-controller-container: automation-controller: Project scm_url argument injection into `git ls-remote --upload-pack` yields RCE on the controller-task control-plane pod

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scmurl field is not validated against values that begin with a dash and is stored and passed verbatim to the git SCM module. Because the module runs git ls-remote with the URL as a positional argument an...

automation-controller: automation-controller: WorkflowJobTemplate /copy/ deep-copy sanitizer omits instance_groups authorization (InstanceGroup use_role bypass to control-plane)

A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unifiedjobtemplate, and credentials of each cloned node and fails to check the instancegroups and executionenvironment...

automation-controller: automation-controller-container: automation-controller: constructed inventory input inventory attachment checks only read permission on the source inventory, allowing a read-only user to clone another tenant's hosts and secrets and run ad hoc commands against them

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching a source inventory to a constructed inventory through the inputinventories relationship endpoint, the controller verifies only that the requesting user can read the source inventory, rather than that...

automation-controller: automation-controller-container: automation-controller: instance group attachment to schedules and workflow job template nodes checks only read permission, allowing use of restricted (controlplane / other-tenant) instance groups and privilege escalation to control-plane code execution

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching an instance group to a schedule or a workflow job template node through the dedicated API relationship endpoint, the controller verifies only that the requesting user can read view the instance group,...