Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Fixed packages 2

Vulnerabilities 5

• Critical 9.9
  CVE-2026-84474

  Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioning-callback host match

  A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret (host_config_key) is exposed to users holding only the read-level view_jobtemplate permission -- both in the job template API representation and…

  Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.7
  Sep 23, 2026
• Critical 9.9
  CVE-2026-84502

  Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane pod

  A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not validated against values that begin with a dash and is stored and passed verbatim to the git SCM module. Because the module runs git ls-remote w…

  Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.7
  Sep 23, 2026
• Critical 9.9
  CVE-2026-84719

  Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)

  A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of each cloned node and fails to check the …

  Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.7
  Sep 23, 2026
• Critical 9.6
  CVE-2026-12564

  Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf

  A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a H…

  Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.7
  Aug 18, 2026
• Critical 9.1
  CVE-2026-75884

  Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups

  A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes…

  Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.7
  Sep 23, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• article
  https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.4/html/red_hat_ansible_automation_platform_release_notes/asynchronous_updates
• article
  https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.4#Installation%20and%20upgrade
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2490556
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2517893
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2527073
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2527096
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2527100
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2527139
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2527195
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2527213
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71115.json
• report
  https://access.redhat.com/security/cve/CVE-2026-12564
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-12564
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-12564
• report
  https://access.redhat.com/security/cve/CVE-2026-75884
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-75884
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-75884
• report
  https://access.redhat.com/security/cve/CVE-2026-84474
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-84474
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-84474
• report
  https://access.redhat.com/security/cve/CVE-2026-84502
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-84502
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-84502
• report
  https://access.redhat.com/security/cve/CVE-2026-84638
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-84638
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-84638
• report
  https://access.redhat.com/security/cve/CVE-2026-84684
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-84684
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-84684
• report
  https://access.redhat.com/security/cve/CVE-2026-84711
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-84711
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-84711
• report
  https://access.redhat.com/security/cve/CVE-2026-84719
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-84719
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-84719