RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Critical) (RHSA-2026:71114)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71114 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...

automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout HTML view via ANSI OSC 8 hyperlink sequences (javascript: anchor) enabling session takeover

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8...

automation-controller: automation-controller-container: automation-controller: CUSTOM_VENV_PATH setting provides filesystem path-existence oracle on control pod

StringListPathField.tointernalvalue calls os.path.exists on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRETKEY, k8s service-account token, receptor sockets, ConfigMap mount...

automation-controller: automation-controller-container: automation-controller: Schedule and WorkflowJobTemplateNode scm_branch prompt bypasses leading-dash git-argument guard

LaunchConfigurationBaseSerializer.scmbranch has no validatescmbranch leading-dash check, unlike Project/JobTemplate/JobLaunch serializers. Schedule and WFJT Node accept --upload-pack=/bin/id as scmbranch. Currently blocked at runtime by jobs.py:1502 ValueError check defense-in-depth, but the API...

automation-controller: automation-controller-container: automation-controller/AWX: Bulk Job Launch checks instance_groups at read level instead of use level, allowing execution-placement authorization bypass

A flaw was found in Ansible Automation Platform's automation-controller AWX. The Bulk Job Launch API POST /api/v2/bulk/joblaunch/ authorizes the requested instancegroups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same...

automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via Schedule/WorkflowJobTemplateNode survey min/max validation error message

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification,...

automation-controller: automation-controller-container: automation-controller: Project scm_url argument injection into `git ls-remote --upload-pack` yields RCE on the controller-task control-plane pod

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scmurl field is not validated against values that begin with a dash and is stored and passed verbatim to the git SCM module. Because the module runs git ls-remote with the URL as a positional argument an...

automation-controller: automation-controller-container: automation-controller: missing use_role authorization on the project signature validation credential foreign key allows a project administrator to bind and use another organization's credential cross-tenant

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. A project has a signature validation credential foreign key used to validate signed project content. Unlike the project's SCM credential, the authorization logic does not verify that the requesting user has use...

automation-controller: automation-controller-container: automation-controller: the AWX_TASK_ENV setting applies arbitrary environment variables to the control-plane web and task processes, enabling TLS interception of external credentials and code execution

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The AWXTASKENV setting accepts arbitrary environment variable keys with no restriction, and its values are applied directly to the running automation controller web and task processes rather than only to sandboxed...

automation-controller: automation-controller-container: automation-controller: organization galaxy credential attachment checks only read permission on the credential, allowing an organization admin with read-only visibility to bind and server-side-use another tenant's Automation Hub API token

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching a Galaxy or Automation Hub credential to an organization through the galaxycredentials relationship endpoint, the controller verifies only that the requesting user can read the credential, rather than...

automation-controller: automation-controller-container: automation-controller: bulk job launch allows setting a workflow node's job reference to an arbitrary unified job, enabling a low-privileged user to cancel and read metadata of jobs in other organizations

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The bulk job launch endpoint builds workflow job nodes from client input using a serializer that leaves the node's job reference -- a field normally set by the workflow task manager after it spawns a child job --...

automation-controller: automation-controller-container: automation-controller: workflow job template node execute permission check bypassed by creating a node with a null unified_job_template and then patching it, allowing a single workflow-admin to execute any other tenant's job template with the victim's credentials (cross-tenant privilege escalation)

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The execute-permission check on a workflow job template node's unified job template is skipped when the node's currently stored unified job template is empty: the check inspects only the existing value, not the...

automation-controller: automation-controller-container: automation-controller: Credential Type env-injector deny-list omits process-hijacking variables (BASH_ENV/LD_PRELOAD) allowing code execution in the execution environment

A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names against a deny-list an ANSIBLE prefix check plus a fixed ENVBLOCKLIST that omits process-hijacking loader variables such as BASHENV, ENV,...

automation-controller: automation-controller-container: automation-controller: container group pod_spec_override mints the automation-controller ServiceAccount token and mounts control-plane namespace secrets into job pods, bypassing automountServiceAccountToken:false (control-plane secret and identity compromise)

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. A user with the delegated Instance Group Admin role on a container group can set a free-form pod specification override that is deep-merged, without filtering, into every job pod launched on that group. The only...

automation-controller: automation-controller: CredentialType injector validation renders attacker-supplied Jinja2 templates synchronously in the web worker, allowing uncontrolled resource consumption (denial of service) and an unhandled-exception (500) via /api/controller/v2/credential_types/

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When a custom credential type is created or updated, the injector configuration is validated by rendering each attacker-supplied Jinja2 template synchronously inside the web request worker, with no limit on iteration...

automation-controller: automation-controller: Project scm_branch/scm_refspec argument injection into git during project sync allows arbitrary file read on the sync host (control-plane ServiceAccount token, SECRET_KEY, and DB credentials on control-plane deployments) leading to full AAP and Kubernetes-namespace compromise

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The Project SCM branch and SCM refspec fields are accepted without rejecting values that begin with a dash and are passed to the git module during project synchronization, where they reach a git checkout/git fetch...

automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ ApiV2PingView, AllowAny over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory node hostnames, node types, UUIDs, heartbeats,...

automation-controller: automation-controller: SystemJob extra_vars.days argument injection into uncontainerized control-plane awx-manage process

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...

automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in Bitbucket Data Center webhook receiver enumerates webhook-enabled job templates

A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target template, causing the endpoint to return HTTP 200 for a...

automation-controller: automation-controller: client IP spoofing in audit/access logs via unrestricted X-Forwarded-For trust

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost...