CVE-2026-71463 Automation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via conditional gating leaks tracebacks

Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts job'job'+'env' and % if job.id 100 % conditional gating bypass both the AST check and the test-render stub has small job.id. At runtime, the gated branch executes and exceptions write full tracebacks...

CVE-2026-71462 Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control pod

StringListPathField.tointernalvalue calls os.path.exists on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRETKEY, k8s service-account token, receptor sockets, ConfigMap mount...

CVE-2026-71462 Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control pod

StringListPathField.tointernalvalue calls os.path.exists on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRETKEY, k8s service-account token, receptor sockets, ConfigMap mount...

CVE-2026-71461 Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler

HostList.list catches bare Exception and returns stre verbatim. Via hostfilter, any authenticated user triggers Django FieldError leaking complete Host model relation graph including internal reverse accessors or PostgreSQL DataError leaking raw database error strings. Two primitives:...

CVE-2026-71460 Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license details via /config/

/api/v2/config/ is protected only by IsAuthenticated. licenseinfo accountnumber, subscriptionid, poolid, sku, supportlevel, instance counts returned to any authenticated user. The superuser/auditor gate only covers projectbasedir/projectlocalpaths/customvirtualenvs, not licenseinfo. Enables socia...

CVE-2026-71460 Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license details via /config/

/api/v2/config/ is protected only by IsAuthenticated. licenseinfo accountnumber, subscriptionid, poolid, sku, supportlevel, instance counts returned to any authenticated user. The superuser/auditor gate only covers projectbasedir/projectlocalpaths/customvirtualenvs, not licenseinfo. Enables socia...

CVE-2026-76648 Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job template secret recovery

CopyAPIView awx/awx/api/generics.py:873 sets permissionclasses = IsAuthenticated,, so DRF's getobject performs no object-level RBAC. The get handler lines 988–991 explicitly guards with request.user.canaccessobj.class, 'read', obj — but post lines 1001–1010 does not. POST only checks:...

CVE-2026-71459 Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structure

JobJobEventsChildrenSummary view has no model/parentmodel. ModelAccessPermission.checkgetpermissions falls through returns True for any authenticated user. The view uses raw getobjector404Job, pk without DRF object-level permission check. Zero-privilege user reads event tree structure,...

CVE-2026-71458 Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumeration

URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. Differential "Not found." vs "No matches..." reveals whether a named resource org,...

CVE-2026-71458 Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumeration

URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. Differential "Not found." vs "No matches..." reveals whether a named resource org,...

CVE-2026-84470

A flaw was found in Ansible Automation Platform's automation-controller AWX. The Bulk Job Launch API POST /api/v2/bulk/joblaunch/ authorizes the requested instancegroups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.6 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.7 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: grafana-operator-fips, steampipe, stakater-reloader, victorialogs, flux-notification-controller, librechat, flux-operator-fips, grafana-rollout-operator, victorialogs-fips, dkron, go, victoriametrics-fips, cert-manager-fips, victoriametrics, victoriametrics-cluster,...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: crossplane, flux-source-controller, wolfictl, gptscript, kargo, flux, scorecard, trivy, skaffold, task, argo-workflows, bom, kaniko, tfsec, k8sgpt, k9s, src-fingerprint, flux-kustomize-controller, pulumi-kubernetes-operator, zarf, argocd-image-updater, timoni,...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: crossplane, flux-source-controller, wolfictl, gptscript, kargo, flux, scorecard, trivy, skaffold, task, argo-workflows, bom, kaniko, tfsec, k8sgpt, k9s, src-fingerprint, flux-kustomize-controller, pulumi-kubernetes-operator, zarf, argocd-image-updater, timoni,...

GO-2026-4910 vulnerabilities

Vulnerabilities for packages: gitlab-runner, kyverno, crossplane, flux-source-controller, wolfictl, gitaly, gptscript, kargo, flux, scorecard, trivy, skaffold, witness, argo-workflows, bom, kaniko, tfsec, cerbos, k9s, src-fingerprint, pulumi-kubernetes-operator, zarf, argocd-image-updater,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: gitlab-runner, terragrunt, cloudflared, crossplane-provider-aws-ec2, crossplane-provider-aws-lambda, skaffold, witness, crossplane-provider-aws-sqs, prometheus-operator, gitlab-pages, spire-server, tkn, pulumi-kubernetes-operator, zarf, prometheus,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: gitlab-runner, influx, db-operator, mongodb-kubernetes-operator, juicefs, pvc-autoresizer, restic, crossplane-provider-aws-ec2, crossplane-provider-aws-lambda, whereabouts, yunikorn-k8shim, calico, git-lfs, s5cmd, k8sgateway, extism, undock, hubble-ui,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: tekton-chains, terragrunt, opentelemetry-collector-contrib, buildkitd, flux-source-controller, aactl, crossplane-provider-azure-sql, rabbitmq-messaging-topology-operator, kargo, slsa-verifier, flux, scorecard, rekor, crossplane-provider-azure-authorization, step-ca,...