Skip to content
OpenAdvisories
High RHSA-2026:34160 11 CVEs

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Published Jul 2, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 15

ReleasePackageFixed in
Red Hat · Ansible Automation Platform Developer 2 ansible_automation_platform_developer:2.6::el9 automation-controller 0:4.7.13-2.el9ap
Red Hat · Ansible Automation Platform Developer 2 ansible_automation_platform_developer:2.6::el9 automation-controller-cli 0:4.7.13-2.el9ap
Red Hat · Ansible Automation Platform Developer 2 ansible_automation_platform_developer:2.6::el9 python3.12-urllib3 0:2.7.0-1.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.6::el9 automation-controller 0:4.7.13-2.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.6::el9 automation-controller-cli 0:4.7.13-2.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.6::el9 automation-controller-server 0:4.7.13-2.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.6::el9 automation-controller-ui 0:4.7.13-2.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.6::el9 automation-controller-venv-tower 0:4.7.13-2.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.6::el9 automation-platform-ui 0:2.6.10-1.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.6::el9 python3.12-pyjwt 0:2.13.0-1.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.6::el9 python3.12-pyjwt+crypto 0:2.13.0-1.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.6::el9 python3.12-pysequoia 0:0.1.34-1.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.6::el9 python3.12-pysequoia-debuginfo 0:0.1.34-1.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.6::el9 python3.12-pysequoia-debugsource 0:0.1.34-1.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.6::el9 python3.12-urllib3 0:2.7.0-1.el9ap

Vulnerabilities 11

  • High 8.9
    CVE-2026-44432

    urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

    urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Br…

    urllib3 urllib3 open-webui katib-suggestion-hyperopt Debian Ubuntu Wolfi PyPI
  • High 8.2
    CVE-2026-44431

    urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

    urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerabili…

    urllib3 urllib3 open-webui katib-suggestion-hyperopt Debian Ubuntu Azure Linux Wolfi PyPI
  • High 7.7
    CVE-2026-44293

    protobufjs: Code injection through bytes field defaults in generated toObject code

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted…

    protobufjs protobuf.js renovate kubeflow-centraldashboard Wolfi npm
  • High 7.5
    CVE-2026-33154 Public exploit

    dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver

    dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates…

    dynaconf dynaconf python-dynaconf python-dynaconf Debian Ubuntu PyPI
  • High 7.5
    CVE-2026-44488

    Axios: Allocation of Resources Without Limits or Throttling in axios

    Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or r…

    axios axios katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-6322

    fast-uri vulnerable to host confusion via percent-encoded authority delimiters

    fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with…

    fast-uri fast-uri langfuse-3-worker prism Debian Ubuntu Wolfi npm
  • High 7.4
    CVE-2026-42035

    Axios: Header Injection via Prototype Pollution

    Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests.…

    axios axios langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  • High 7.4
    CVE-2026-42784

    Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

    A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the b…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 10 Red Hat OpenShift Container Platform 4 Linux Debian Ubuntu Azure Linux
  • High 7.4
    CVE-2026-48526

    PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

    PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker t…

    jpadilla pyjwt kserve-storage-controller superset-6.0 Debian Ubuntu Azure Linux Wolfi PyPI
  • High 7.0
    CVE-2026-44495

    Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

    Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Ob…

    axios axios katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm
  • Medium 6.0
    CVE-2026-41240

    DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

    DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit c361baa added an early exit for FORBID_AT…

    cure53 DOMPurify opensearch-dashboards-3 nextcloud-server-33 Debian Ubuntu Wolfi npm

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates
  • article
    https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2449774
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461147
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2461606
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2466684
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477104
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477154
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477167
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2482734
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2487937
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2487949
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34160.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-6322
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-6322
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-6322
  • article
    https://cna.openjsf.org/security-advisories.html
  • article
    https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc
  • report
    https://access.redhat.com/security/cve/CVE-2026-33154
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-33154
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-33154
  • article
    https://github.com/dynaconf/dynaconf/commit/2fbb45ee36b8c0caa5b924fe19f3c1a5e8603fa7
  • article
    https://github.com/dynaconf/dynaconf/releases/tag/3.2.13
  • article
    https://github.com/dynaconf/dynaconf/security/advisories/GHSA-pxrr-hq57-q35p
  • report
    https://access.redhat.com/security/cve/CVE-2026-41240
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-41240
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-41240
  • article
    https://github.com/cure53/DOMPurify/commit/c361baa18dbdcb3344a41110f4c48ad85bf48f80
  • article
    https://github.com/cure53/DOMPurify/releases/tag/3.4.0
  • article
    https://github.com/cure53/DOMPurify/security/advisories/GHSA-h7mw-gpvr-xq4m
  • report
    https://access.redhat.com/security/cve/CVE-2026-42035
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42035
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42035
  • article
    https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9
  • report
    https://access.redhat.com/security/cve/CVE-2026-42784
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2464122
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42784
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42784