Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Fixed packages 5

Vulnerabilities 10

• Critical 9.1
  CVE-2026-90711

  proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

  proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, …

  proxy-addr proxy-addr langfuse-3-worker kubeflow-centraldashboard Debian Ubuntu Azure Linux Wolfi npm
  Sep 15, 2026
• High 8.1
  CVE-2026-90959

  Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft

  A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a stri…

  Red Hat Red Hat Satellite 6 Red Hat Ansible Automation Platform 2 Red Hat Update Infrastructure 5
  Sep 24, 2026
• High 7.5
  CVE-2026-87776

  compression vulnerable to Denial of Service via memory leak on premature response close

  compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted c…

  compression compression jupyter-base-notebook python-tensorboard Debian Ubuntu Azure Linux Wolfi npm
  Sep 11, 2026
• High 7.4
  CVE-2026-102266

  PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

  PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contain…

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026
• High 7.4
  CVE-2026-102267

  PyJWT: PyJWKClient follows redirects when fetching JWKS

  PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an atta…

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026
• High 7.4
  CVE-2026-102271

  PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

  PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes …

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026
• High 7.4
  CVE-2026-102272

  PyJWT BOM Bypass

  PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occ…

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026
• High 7.4
  CVE-2026-102273

  PyJWT accepts public JWK containers as HMAC secrets

  PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an app…

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026
• Medium 6.8
  CVE-2026-94416

  Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery

  An authorization bypass was found in the Ansible Automation Platform (AAP) gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. Because service-key creation is not restricted to the ins…

  Red Hat Red Hat Ansible Automation Platform 2 Red Hat Ansible Automation Platform 2.7 Red Hat Ansible Automation Platform 2.6 for RHEL 9
  Sep 24, 2026
• Medium 6.6
  CVE-2026-45820

  fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives

  fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 cause…

  101arrowz fflate langfuse-3-worker langfuse-3-compat Wolfi npm
  Jul 22, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates
• article
  https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2506034
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2531852
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2533037
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2533602
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2537465
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2542671
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2542687
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2542690
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2542695
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2542697
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_87004.json
• report
  https://access.redhat.com/security/cve/CVE-2026-45820
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-45820
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-45820
• article
  https://github.com/101arrowz/fflate/blob/f7873560ad229c22c4b23b06c6a3806ffde77569/src/index.ts#L2714
• article
  https://www.npmjs.com/package/fflate
• report
  https://access.redhat.com/security/cve/CVE-2026-87776
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-87776
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-87776
• article
  https://cna.openjsf.org/security-advisories.html
• article
  https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95
• report
  https://access.redhat.com/security/cve/CVE-2026-90711
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-90711
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-90711
• article
  https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h
• report
  https://access.redhat.com/security/cve/CVE-2026-90959
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-90959
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-90959
• report
  https://access.redhat.com/security/cve/CVE-2026-94416
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-94416
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-94416
• article
  https://github.com/ansible/ansible.platform/pull/254
• article
  https://github.com/ansible/jewel/pull/235
• report
  https://access.redhat.com/security/cve/CVE-2026-102266
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-102266
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-102266