CVE-2026-76648

CopyAPIView awx/awx/api/generics.py:873 sets permissionclasses = IsAuthenticated,, so DRF's getobject performs no object-level RBAC. The get handler lines 988–991 explicitly guards with request.user.canaccessobj.class, 'read', obj — but post lines 1001–1010 does not. POST only checks:...

CVE-2026-75884: Incomplete List of Disallowed Inputs

A flaw was found in AWX. The container group podspecoverride field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can...

CVE-2021-20253

CVE-2021-20253: Escalada de Privilegios mediante Escape de Aislamiento de Trabajos en Ansible Tower Se encontró una falla en ansible-tower. La instalación predeterminada es vulnerable a un escape de aislamiento de trabajos que permite a un atacante elevar sus privilegios desde un usuario con poco...

CVE-2026-76220 vulnerabilities

Vulnerabilities for packages: awx, checkov, opal, mlflow...

CVE-2026-76218 vulnerabilities

Vulnerabilities for packages: awx, checkov, opal, mlflow...

GHSA-M4F3-G4CQ-HQRX vulnerabilities

Vulnerabilities for packages: datahub-ingestion-fips, mlflow, awx, datahub-ingestion, opal, mlflow-fips, checkov...

CVE-2026-67322 vulnerabilities

Vulnerabilities for packages: datahub-ingestion-fips, mlflow, awx, datahub-ingestion, opal, mlflow-fips, checkov...

CVE-2026-67323 vulnerabilities

Vulnerabilities for packages: datahub-ingestion-fips, mlflow, awx, datahub-ingestion, opal, checkov...

GHSA-4VPG-PFJ8-M33Q vulnerabilities

Vulnerabilities for packages: datahub-ingestion-fips, mlflow, awx, datahub-ingestion, opal, checkov...

CVE-2026-67325 vulnerabilities

Vulnerabilities for packages: datahub-ingestion-fips, mlflow, awx, datahub-ingestion, opal, checkov...

GHSA-6R2R-WW24-7H52 vulnerabilities

Vulnerabilities for packages: datahub-ingestion-fips, mlflow, awx, datahub-ingestion, opal, checkov...

CVE-2026-76219 vulnerabilities

Vulnerabilities for packages: awx, checkov, opal, mlflow...

GHSA-W672-239G-C3GR vulnerabilities

Vulnerabilities for packages: awx, checkov, opal, mlflow...

CVE-2026-76222 vulnerabilities

Vulnerabilities for packages: awx, checkov, opal, mlflow...

CVE-2026-76217 vulnerabilities

Vulnerabilities for packages: awx, checkov, opal, mlflow...

GHSA-7JX3-JQCP-HHGC vulnerabilities

Vulnerabilities for packages: awx, checkov, opal, mlflow...

CVE-2026-67320 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, langfuse-fips, gitlab-rails-ce-fips, gitlab-rails-ce, wazuh-dashboard-fips, opensearch-dashboards, azurite, kibana, wazuh-dashboard, kubeflow-centraldashboard, langfuse, opensearch-dashboards-fips, awx, semaphore, lerna, nextcloud-server, prism,...

GHSA-39J5-W47M-2GMV vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, langfuse, opensearch-dashboards-fips, awx, langfuse-fips, librechat, lerna, redisinsight, semaphore, kibana, wazuh-dashboard, gitlab-rails-ce-fips, kubeflow-centraldashboard, nextcloud-server, gitlab-rails-ce, wazuh-dashboard-fips, prism,...

CVE-2026-67318 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, langfuse, opensearch-dashboards-fips, awx, langfuse-fips, librechat, lerna, redisinsight, semaphore, kibana, wazuh-dashboard, gitlab-rails-ce-fips, kubeflow-centraldashboard, nextcloud-server, gitlab-rails-ce, wazuh-dashboard-fips, prism,...

CVE-2026-84470

A flaw was found in Ansible Automation Platform's automation-controller AWX. The Bulk Job Launch API POST /api/v2/bulk/joblaunch/ authorizes the requested instancegroups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same...