CLEANSTART-2026-GY60035 Security fix for GHSA-qpw4-5x99-6vjp applied in: bank-vaults 1.32.1-r1, kubernetes-csi-external-snapshotter 8.6.0-r1, yunikorn-k8shim 1.8.0-r1, temporal-server-fips 1.31.1-r1, ollama-fips 0.34.4-r2, flux-image-automation-controller 1.2.1-r1, kumactl 2.14.0-r1, velero-fips 1.18.2-r1, velero-fips 1.18.2-r2, velero-fips 1.18.2-r3, fulcio 1.8.7-r2

GHSA-qpw4-5x99-6vjp affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QL47150 Security fix for GHSA-9m57-25v3-79x9 applied in: bank-vaults 1.32.1-r1, kubernetes-csi-external-snapshotter 8.6.0-r1, yunikorn-k8shim 1.8.0-r1, temporal-server-fips 1.31.1-r1, ollama-fips 0.34.4-r2, flux-image-automation-controller 1.2.1-r1, kumactl 2.14.0-r1, velero-fips 1.18.2-r1, velero-fips 1.18.2-r2, velero-fips 1.18.2-r3, fulcio 1.8.7-r2

GHSA-9m57-25v3-79x9 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-IH80473 Security fix for GHSA-45gg-vh54-h5m9 applied in: bank-vaults 1.32.1-r1, kubernetes-csi-external-snapshotter 8.6.0-r1, yunikorn-k8shim 1.8.0-r1, temporal-server-fips 1.31.1-r1, ollama-fips 0.34.4-r2, flux-image-automation-controller 1.2.1-r1, kumactl 2.14.0-r1, velero-fips 1.18.2-r1, velero-fips 1.18.2-r2, velero-fips 1.18.2-r3, fulcio 1.8.7-r2

GHSA-45gg-vh54-h5m9 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OC21392 Security fix for GHSA-78mq-xcr3-xm33 applied in: bank-vaults 1.32.1-r1, kubernetes-csi-external-snapshotter 8.6.0-r1, yunikorn-k8shim 1.8.0-r1, temporal-server-fips 1.31.1-r1, ollama-fips 0.34.4-r2, flux-image-automation-controller 1.2.1-r1, kumactl 2.14.0-r1, velero-fips 1.18.2-r1, velero-fips 1.18.2-r2, velero-fips 1.18.2-r3, fulcio 1.8.7-r2

GHSA-78mq-xcr3-xm33 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CM19528 Security fix for GHSA-q4h4-gmj2-qvw2 applied in: bank-vaults 1.32.1-r1, kubernetes-csi-external-snapshotter 8.6.0-r1, yunikorn-k8shim 1.8.0-r1, temporal-server-fips 1.31.1-r1, ollama-fips 0.34.4-r2, flux-image-automation-controller 1.2.1-r1, kumactl 2.14.0-r1, velero-fips 1.18.2-r1, velero-fips 1.18.2-r2, velero-fips 1.18.2-r3, fulcio 1.8.7-r2

GHSA-q4h4-gmj2-qvw2 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OK40538 Security fix for GHSA-w879-237q-wc7r applied in: kubernetes-csi-external-snapshotter 8.6.0-r1, bank-vaults 1.32.1-r1, yunikorn-k8shim 1.8.0-r1, temporal-server-fips 1.31.1-r1, ollama-fips 0.34.4-r2, flux-image-automation-controller 1.2.1-r1, kumactl 2.14.0-r1, velero-fips 1.18.2-r1, velero-fips 1.18.2-r2, velero-fips 1.18.2-r3, fulcio 1.8.7-r2

GHSA-w879-237q-wc7r affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MJ05822 Security fix for GHSA-jppx-rxg9-jmrx applied in: kubernetes-csi-external-snapshotter 8.6.0-r1, bank-vaults 1.32.1-r1, yunikorn-k8shim 1.8.0-r1, temporal-server-fips 1.31.1-r1, ollama-fips 0.34.4-r2, flux-image-automation-controller 1.2.1-r1, kumactl 2.14.0-r1, velero-fips 1.18.2-r1, velero-fips 1.18.2-r2, velero-fips 1.18.2-r3, fulcio 1.8.7-r2

GHSA-jppx-rxg9-jmrx affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VH12649 Security fix for GHSA-89gr-r52h-f8rx applied in: kubernetes-csi-external-snapshotter 8.6.0-r1, bank-vaults 1.32.1-r1, yunikorn-k8shim 1.8.0-r1, temporal-server-fips 1.31.1-r1, ollama-fips 0.34.4-r2, flux-image-automation-controller 1.2.1-r1, kumactl 2.14.0-r1, velero-fips 1.18.2-r1, velero-fips 1.18.2-r2, velero-fips 1.18.2-r3, fulcio 1.8.7-r2

GHSA-89gr-r52h-f8rx affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-TE17552 Security fix for GHSA-x527-x647-q7gg applied in: kubernetes-csi-external-snapshotter 8.6.0-r1, bank-vaults 1.32.1-r1, yunikorn-k8shim 1.8.0-r1, temporal-server-fips 1.31.1-r1, ollama-fips 0.34.4-r2, flux-image-automation-controller 1.2.1-r1, kumactl 2.14.0-r1, velero-fips 1.18.2-r1, velero-fips 1.18.2-r2, velero-fips 1.18.2-r3, fulcio 1.8.7-r2

GHSA-x527-x647-q7gg affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-BC10849 Security fix for GHSA-rm3j-f69w-wqmq applied in: kubernetes-csi-external-snapshotter 8.6.0-r1, bank-vaults 1.32.1-r1, yunikorn-k8shim 1.8.0-r1, temporal-server-fips 1.31.1-r1, ollama-fips 0.34.4-r2, flux-image-automation-controller 1.2.1-r1, kumactl 2.14.0-r1, velero-fips 1.18.2-r1, velero-fips 1.18.2-r2, velero-fips 1.18.2-r3, fulcio 1.8.7-r2

GHSA-rm3j-f69w-wqmq affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-YX87977 Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default

Security vulnerability affects the flux-image-automation-controller package. Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default...

RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Critical) (RHSA-2026:71114)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71114 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...

automation-controller: automation-controller-container: automation-controller: CUSTOM_VENV_PATH setting provides filesystem path-existence oracle on control pod

StringListPathField.tointernalvalue calls os.path.exists on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRETKEY, k8s service-account token, receptor sockets, ConfigMap mount...

automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and X-Forwarded-For spoofing of provisioning-callback host match

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret hostconfigkey is exposed to users holding only the read-level viewjobtemplate permission -- both in the job template API representation and in the activity stream -- and the...

automation-controller: automation-controller-container: automation-controller: GALAXY_TASK_ENV setting is not filtered for dynamic-linker / interpreter environment variables, allowing a system administrator to achieve code execution in the project-update execution environment

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The GALAXYTASKENV setting, whose values are added to the environment of the ansible-galaxy commands run during project updates, is not validated to exclude dynamic-linker and interpreter environment variables such a...

automation-controller: automation-controller: CredentialType injector validation renders attacker-supplied Jinja2 templates synchronously in the web worker, allowing uncontrolled resource consumption (denial of service) and an unhandled-exception (500) via /api/controller/v2/credential_types/

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When a custom credential type is created or updated, the injector configuration is validated by rendering each attacker-supplied Jinja2 template synchronously inside the web request worker, with no limit on iteration...

automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ ApiV2PingView, AllowAny over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory node hostnames, node types, UUIDs, heartbeats,...

automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-CA certificates for caller-chosen (and case-variant impersonating) hostnames

A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the Common Name, DNS...

automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in Bitbucket Data Center webhook receiver enumerates webhook-enabled job templates

A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target template, causing the endpoint to return HTTP 200 for a...

automation-controller: automation-controller-container: automation-controller: Schedule and WorkflowJobTemplateNode scm_branch prompt bypasses leading-dash git-argument guard

LaunchConfigurationBaseSerializer.scmbranch has no validatescmbranch leading-dash check, unlike Project/JobTemplate/JobLaunch serializers. Schedule and WFJT Node accept --upload-pack=/bin/id as scmbranch. Currently blocked at runtime by jobs.py:1502 ValueError check defense-in-depth, but the API...