CVE-2026-18141

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible EDA. An unauthenticated remote attacker can bypass mutual Transport Layer Security mTLS authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP...

EUVD-2026-51556

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible EDA. An unauthenticated remote attacker can bypass mutual Transport Layer Security mTLS authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP...

CVE-2026-18141 Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible EDA. An unauthenticated remote attacker can bypass mutual Transport Layer Security mTLS authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP...

CVE-2026-18141

The CVE-2026-18141 entry concerns aap-gateway in Ansible Automation Platform’s Event-Driven Ansible (EDA). Affected component: aap-gateway. Vulnerability: an unauthenticated remote attacker can bypass mutual TLS on event streams by manipulating the event stream URL and forging the HTTP Subject he...

EUVD-2026-51314

A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and cop...

EUVD-2026-51315

A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the leappoldpostgresqldata option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a local non-root user on the managed node to read...

PT-2026-66778

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible EDA. An unauthenticated remote attacker can bypass mutual Transport Layer Security mTLS authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP...

CVE-2026-68563

A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the leappoldpostgresqldata option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a local non-root user on the managed node to read...

CVE-2026-68563 Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure of postgresql data via insecure backup permissions

A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the leappoldpostgresqldata option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a local non-root user on the managed node to read...

CVE-2026-68562

A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and cop...

Linux Distros Unpatched Vulnerability : CVE-2026-68562

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When a...

Linux Distros Unpatched Vulnerability : CVE-2026-68563

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the leappoldpostgresqldata option is...

CVE-2026-65923

A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-side requests. The issue primarily affects confidentiality and integrity and has been addressed in fixed Artifactory versions...

CVE-2026-65923 Potential server-side request forgery in Artifactory Ansible repository handling

A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-side requests. The issue primarily affects confidentiality and integrity and has been addressed in fixed Artifactory versions...

CVE-2026-65923 Potential server-side request forgery in Artifactory Ansible repository handling

A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-side requests. The issue primarily affects confidentiality and integrity and has been addressed in fixed Artifactory versions...

CVE-2026-65923

The CVE-2026-65923 entry documents a URL validation weakness in JFrog Artifactory Ansible repository handling that could, under specific repository access conditions, trigger unintended server-side requests. Affected component: Artifactory’s Ansible repository handling (details align with Artifac...

CVE-2026-65923

A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-side requests. The issue primarily affects confidentiality and integrity and has been addressed in fixed Artifactory versions...

EUVD-2026-49582

A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-side requests. The issue primarily affects confidentiality and integrity and has been addressed in fixed Artifactory versions...

CVE-2026-12383

A flaw was found in the Event-Driven Ansible EDA server. The ExternalEventStreamViewSet uses permissive access controls permissionclasses=AllowAny, authenticationclasses= and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a...

CVE-2026-12383

A flaw was found in the Event-Driven Ansible EDA server. The ExternalEventStreamViewSet uses permissive access controls permissionclasses=AllowAny, authenticationclasses= and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a...