CVE-2024-0690

CVE-2024-0690 affects ansible-core and describes an information disclosure where output can leak sensitive data when ANSIBLE_NO_LOG is ignored in certain tasks (e.g., loop items). The vulnerability is evidenced across multiple sources in the connected set, including Red Hat/Debian/AlmaLinux advis...

CVE-2023-5115

The CVE-2023-5115 issue is an absolute path traversal in the Ansible automation platform, enabling a maliciously crafted Ansible role (via a symlink) to overwrite files outside the intended extraction path. Affected component is Ansible (ansible-core/associated packages), with root cause describe...

CVE-2023-5764

CVE-2023-5764 describes a template-injection flaw in Ansible where the controller’s internal templating can drop the unsafe designation from template data, enabling a crafted file to inject templates during templating data provisioning. This affects Ansible’s templating operations and could allow...

CVE-2023-4380

CVE-2023-4380 affects Red Hat Ansible Automation Platform 2.4. The issue is a logic flaw in which private project credentials could be logged in plaintext during project import, exposing sensitive data and impacting confidentiality and integrity. The Red Hat advisory RHSA-2023:4693 documents fixe...

CVE-2023-3971

The CVE-2023-3971 HTML injection flaw affects Red Hat Ansible Automation Platform’s Automation Controller UI (Controller). The issue allows an attacker to craft a malicious login page to capture credentials, enabling complete compromise per the CVE description. Remediation is in RHSA-2023:4590/RH...

CVE-2024-10033

CVE-2024-10033 is an XSS vulnerability in the aap-gateway component of Red Hat Ansible Automation Platform (automation-gateway). The associated Red Hat advisory RHSA-2024:8534 lists this issue among security fixes and notes an upgrade path for the platform (automation-gateway updated to 2.5.3). T...

CVE-2025-9907

CVE-2025-9907 affects Red Hat Ansible Automation Platform (Event-Driven Ansible, EDA) Event Stream API. In test mode, the test_headers exposure allows leakage of internal headers and sensitive client credentials, with potential impact including credential exposure, internal infrastructure detail ...

CVE-2025-9909

The CVE-2025-9909 issue affects Red Hat Ansible Automation Platform Gateway route creation: improper gateway_path handling allows an attacker with admin privileges to create misleading routes (double-slash prefix) to intercept credentials, potentially enabling persistent backdoors. It is describe...

CVE-2025-9908

The CVE-2025-9908 entry concerns Red Hat Ansible Automation Platform (AAP) Event-Driven Ansible (EDA) Event Streams. A authenticated user can exfiltrate sensitive internal headers (e.g., X-Trusted-Proxy, X-Envoy-*) and event stream URLs through crafted requests and job templates, enabling header ...