Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Fixed packages 42

Vulnerabilities 12

• High 8.8
  CVE-2026-27606 Public exploit

  Rollup 4 has Arbitrary File Write via Path Traversal

  Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization…

  rollup rollup langfuse-3-worker langfuse-3 Debian Ubuntu Wolfi npm
  Feb 25, 2026
• High 8.7
  CVE-2026-26996

  minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

  minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed…

  isaacs minimatch langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  Feb 20, 2026
• High 8.3
  CVE-2026-6266

  Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linking

  A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows a …

  Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.6
  May 4, 2026
• High 8.2
  CVE-2026-12382

  Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing

  A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated re…

  Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.7
  Jul 15, 2026
• High 7.5
  CVE-2025-14550

  Potential denial-of-service vulnerability via repeated headers when using ASGI

  An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (suc…

  djangoproject Django asgiref python-django Debian Ubuntu Alpine PyPI
  Feb 3, 2026
• High 7.5
  CVE-2025-69534

  Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParse…

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Wolfi PyPI
  Mar 5, 2026
• High 7.5
  CVE-2026-23490

  pyasn1 has a DoS vulnerability in decoder

  pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.

  pyasn1 pyasn1 open-webui katib-earlystopping Debian Ubuntu Wolfi PyPI
  Jan 16, 2026
• High 7.5
  CVE-2026-25679

  Incorrect parsing of IPv6 host literals in net/url

  url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

  Go standard library net/url langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 6, 2026
• High 7.5
  CVE-2026-30922

  pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

  pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payl…

  pyasn1 pyasn1 kubeflow-pipelines-apiserver airflow-3 Debian Ubuntu Azure Linux Wolfi PyPI
  Mar 18, 2026
• High 7.5
  CVE-2026-32597

  PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

  PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the librar…

  jpadilla pyjwt open-webui airflow-3 Debian Ubuntu Azure Linux Wolfi PyPI
  Mar 12, 2026
• High 7.2
  CVE-2026-27459

  pyOpenSSL DTLS cookie callback buffer overflow

  pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL…

  pyca pyopenssl airflow-3 py3-cassandra-medusa Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Mar 17, 2026
• Medium 5.3
  CVE-2026-39373

  JWCrypto: JWE ZIP decompression bomb

  JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch for CVE-2024-28102 limits input token …

  Latchset jwcrypto python-jwcrypto python-jwcrypto Debian Ubuntu Azure Linux Wolfi PyPI
  Apr 7, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/html/release_notes/patch_releases
• article
  https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2430472
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2436341
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2441268
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442530
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2444839
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2445356
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2447194
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2448503
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2448553
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456187
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2458142
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13508.json
• report
  https://access.redhat.com/security/cve/CVE-2025-14550
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-14550
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-14550
• article
  https://docs.djangoproject.com/en/dev/releases/security/
• article
  https://groups.google.com/g/django-announce
• article
  https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2025-69534
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-69534
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-69534
• article
  https://github.com/Python-Markdown/markdown
• article
  https://github.com/Python-Markdown/markdown/actions/runs/15736122892
• article
  https://github.com/Python-Markdown/markdown/issues/1534
• report
  https://access.redhat.com/security/cve/CVE-2026-6266
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-6266
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-6266
• report
  https://access.redhat.com/security/cve/CVE-2026-12382
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2489126
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-12382
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-12382
• report
  https://access.redhat.com/security/cve/CVE-2026-23490
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-23490
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-23490
• article
  https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970
• article
  https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2