Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Fixed packages 14

Vulnerabilities 20

• Critical 9.8
  CVE-2026-67324

  GitPython 3.1.50 Authentication Bypass via Joined Short Options

  GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., mul…

  gitpython-developers GitPython gitpython python-git Debian Ubuntu PyPI
  Aug 1, 2026
• High 8.8
  CVE-2026-15307

  Server-side file-write and request forgery via spatial lookups

  An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial l…

  djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  Aug 4, 2026
• High 8.8
  CVE-2026-67325

  GitPython before 3.1.51 Command Injection via option prefix abbreviation

  GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload…

  gitpython-developers GitPython checkov gitpython Debian Ubuntu Wolfi PyPI
  Aug 1, 2026
• High 8.4
  CVE-2026-67323

  GitPython before 3.1.51 Command Injection via unguarded Git options

  GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally,…

  gitpython-developers GitPython checkov gitpython Debian Ubuntu Wolfi PyPI
  Aug 1, 2026
• High 8.1
  CVE-2026-73620

  GitPython before 3.1.57 Arbitrary File Overwrite and Read

  GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read…

  gitpython-developers GitPython gitpython python-git Debian Ubuntu PyPI
  Aug 13, 2026
• High 7.7
  CVE-2026-44705

  tmp: Path Traversal via unsanitized prefix/postfix enables directory escape

  tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By…

  raszi node-tmp katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi npm
  Jun 11, 2026
• High 7.7
  CVE-2026-71365

  Awx: webhook status callback ssrf leaks the git pat

  A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming webhook payload without v…

  Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.7
  Aug 18, 2026
• High 7.7
  CVE-2026-71366

  Awx: notification backends allow ssrf and credential leakage

  A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the ta…

  Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.7
  Aug 24, 2026
• High 7.5
  CVE-2026-12143

  form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

  form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage …

  form-data form-data langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Wolfi npm
  Jun 12, 2026
• High 7.5
  CVE-2026-59886

  pyasn1: Uncontrolled resource consumption when converting decoded REAL values

  pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a…

  pyasn1 pyasn1 kubeflow-pipelines-apiserver airflow-3 Debian Ubuntu Azure Linux Wolfi PyPI
  Jul 14, 2026
• High 7.5
  CVE-2026-67322

  GitPython before 3.1.52 Environment Variable Exfiltration via clone_from

  GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is passed through Git.polish_url(), which on non-Cygwin platforms calls os.path.expandvars() on the URL before invoking git clone. …

  gitpython-developers GitPython checkov gitpython Debian Ubuntu Wolfi PyPI
  Aug 1, 2026
• High 7.5
  CVE-2026-78677

  GitPython before 3.1.59 Path Traversal via separate-git-dir

  GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separate_git_dir parameter to Repo.clone_from() or Repo.clone()…

  gitpython-developers GitPython gitpython python-git Debian Alpine PyPI
  Aug 25, 2026
• High 7.2
  CVE-2026-71364

  Awx: project archive extraction allows path traversal file writes

  A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary…

  Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.7
  Aug 24, 2026
• High 7.1
  CVE-2026-69244

  AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

  AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possib…

  aio-libs aiohttp open-webui airflow-3 Debian Ubuntu Azure Linux Wolfi PyPI
  Aug 3, 2026
• Medium 6.5
  CVE-2026-78679

  GitPython before 3.1.59 Arbitrary File Read via TagReference.create

  GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file=<path> to read arbitrary files, with con…

  gitpython-developers GitPython gitpython python-git Debian PyPI
  Aug 25, 2026
• Medium 6.4
  CVE-2026-34993

  AIOHTTP Vulnerable to Deserialization of Untrusted Data

  AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's…

  aio-libs aiohttp open-webui katib-earlystopping Debian Ubuntu Azure Linux Wolfi PyPI
  Jun 2, 2026
• Medium 6.3
  CVE-2026-69243 Public exploit

  AIOHTTP: HTTP request smuggling via WebSocket upgrade

  AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to exec…

  aio-libs aiohttp open-webui airflow-3 Debian Ubuntu Azure Linux Wolfi PyPI
  Aug 3, 2026
• Medium 5.3
  CVE-2026-39373

  JWCrypto: JWE ZIP decompression bomb

  JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch for CVE-2024-28102 limits input token …

  Latchset jwcrypto python-jwcrypto python-jwcrypto Debian Ubuntu Azure Linux Wolfi PyPI
  Apr 7, 2026
• Medium 5.3
  CVE-2026-44545

  Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service

  daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or f…

  djangoproject daphne daphne py3-daphne Debian Ubuntu Alpine PyPI
  Jun 3, 2026
• Medium 4.7
  CVE-2026-52902

  Awxkit: path traversal via yaml !include directive

  A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a …

  Red Hat Red Hat Ansible Automation Platform 2 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.5 for RHEL 9 PyPI
  Jun 9, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates
• article
  https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456187
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2484099
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2484377
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2486729
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2487946
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2488480
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2500041
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2509975
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2509976
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2510021
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2510032
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2510825
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2510831
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2511095
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2511900
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2511901
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2511902
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2515261
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59136.json
• report
  https://access.redhat.com/security/cve/CVE-2026-12143
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-12143
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-12143
• article
  https://cwe.mitre.org/data/definitions/93.html
• article
  https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435
• article
  https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229
• article
  https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045
• article
  https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx
• article
  https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data
• article
  https://www.npmjs.com/package/form-data
• report
  https://access.redhat.com/security/cve/CVE-2026-15307
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-15307
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-15307
• article
  https://docs.djangoproject.com/en/dev/releases/security/
• article
  https://github.com/django/django/commit/115ffd0463a765ab1cc93de18e94b5459b8a300e
• article
  https://github.com/django/django/commit/208f80cb682868b584ed0a78f23e4ba6304212aa
• article
  https://github.com/django/django/commit/39b3e2d0c743a338def6c473086ebc06865e86b6