Red Hat Ansible Automation Platform: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 24

• Critical 9.3
  CVE-2026-63374

  AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

  AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with ID…

  agronholm anyio open-webui kserve-storage-controller Debian Ubuntu Wolfi PyPI
  Sep 22, 2026
• Critical 9.1
  CVE-2026-102268 Public exploit

  PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

  PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mix…

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026
• Critical 9.1
  CVE-2026-90711

  proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

  proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, …

  proxy-addr proxy-addr langfuse-3-worker kubeflow-centraldashboard Debian Ubuntu Azure Linux Wolfi npm
  Sep 15, 2026
• High 8.9
  CVE-2026-97689

  urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

  urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a l…

  urllib3 urllib3 open-webui kubeflow-pipelines-apiserver Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 29, 2026
• High 8.8
  CVE-2026-104851 Public exploit

  fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

  fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Templa…

  fsspec filesystem_spec open-webui kserve-storage-controller Debian Ubuntu Wolfi PyPI
  Oct 2, 2026
• High 8.8
  CVE-2026-87817

  GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation

  GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hoo…

  gitpython-developers GitPython gitpython python-git Debian Ubuntu PyPI
  Sep 9, 2026
• High 8.5
  CVE-2026-92982

  Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection

  A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitiza…

  Red Hat Red Hat OpenShift Container Platform 4 Red Hat OpenShift Container Platform 5 Red Hat Ansible Automation Platform 2
  Oct 15, 2026
• High 8.1
  CVE-2026-90959

  Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft

  A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a stri…

  Red Hat Red Hat Satellite 6 Red Hat Ansible Automation Platform 2 Red Hat Update Infrastructure 5
  Sep 24, 2026
• High 7.8
  CVE-2026-102925

  virtualenv bash and fish activation scripts execute commands embedded in paths

  virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh scri…

  pypa virtualenv py3-cassandra-medusa python-virtualenv Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 29, 2026
• High 7.8
  CVE-2026-11332

  Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

  A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git con…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux PyPI
  Jun 5, 2026
• High 7.7
  CVE-2026-102930

  virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

  virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, download_wheel() accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative diges…

  pypa virtualenv py3-cassandra-medusa python-virtualenv Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 29, 2026
• High 7.6
  CVE-2026-97687

  urllib3: HTTPS proxy TLS configuration may be ignored or overridden

  urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain…

  urllib3 urllib3 open-webui kubeflow-pipelines-apiserver Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 29, 2026
• High 7.5
  CVE-2026-103262

  Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

  Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that acc…

  tornadoweb tornado python-tornado python-tornado Debian Ubuntu Azure Linux PyPI
  Oct 1, 2026
• High 7.5
  CVE-2026-87776

  compression vulnerable to Denial of Service via memory leak on premature response close

  compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted c…

  compression compression jupyter-base-notebook python-tensorboard Debian Ubuntu Azure Linux Wolfi npm
  Sep 11, 2026
• High 7.4
  CVE-2026-102266

  PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

  PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contain…

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026
• High 7.4
  CVE-2026-102267

  PyJWT: PyJWKClient follows redirects when fetching JWKS

  PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an atta…

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026
• High 7.4
  CVE-2026-102271

  PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard

  PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes …

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026
• High 7.4
  CVE-2026-102272

  PyJWT BOM Bypass

  PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occ…

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026
• High 7.4
  CVE-2026-102273

  PyJWT accepts public JWK containers as HMAC secrets

  PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an app…

  jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 28, 2026
• High 7.3
  CVE-2026-102937

  virtualenv: Command injection via --prompt in activate.bat (batch activator)

  virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUA…

  pypa virtualenv py3-cassandra-medusa python-virtualenv Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 29, 2026
• High 7.2
  CVE-2026-27459

  pyOpenSSL DTLS cookie callback buffer overflow

  pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL…

  pyca pyopenssl airflow-3 py3-cassandra-medusa Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Mar 17, 2026
• Medium 6.8
  CVE-2026-94416

  Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery

  An authorization bypass was found in the Ansible Automation Platform (AAP) gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. Because service-key creation is not restricted to the ins…

  Red Hat Red Hat Ansible Automation Platform 2 Red Hat Ansible Automation Platform 2.7 Red Hat Ansible Automation Platform 2.6 for RHEL 9
  Sep 24, 2026
• Medium 6.6
  CVE-2026-45820

  fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives

  fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 cause…

  101arrowz fflate langfuse-3-worker langfuse-3-compat Wolfi npm
  Jul 22, 2026
• Medium 5.8
  CVE-2026-102938

  virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

  virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_values() parses the file with str.splitlines() and accepts the…

  pypa virtualenv py3-cassandra-medusa python-virtualenv Debian Ubuntu Azure Linux Wolfi PyPI
  Sep 29, 2026

Revision history

1. 2026-11-12 #12

   Neue Updates von Red Hat aufgenommen

2. 2026-11-11 #11

   Neue Updates von Red Hat aufgenommen

3. 2026-11-10 #10

   Neue Updates von Red Hat und IBM aufgenommen

4. 2026-11-09 #9

   Neue Updates von Red Hat aufgenommen

5. 2026-11-04 #8

   Neue Updates von Red Hat und Oracle Linux aufgenommen

6. 2026-11-03 #7

   Neue Updates von Rocky Enterprise Software Foundation und Red Hat aufgenommen

7. 2026-11-02 #6

   Neue Updates von IBM aufgenommen

8. 2026-10-29 #5

   Neue Updates von Red Hat und Debian aufgenommen

9. 2026-10-26 #4

   Neue Updates von Red Hat und SUSE aufgenommen

10. 2026-10-25 #3

    Neue Updates von openSUSE aufgenommen

11. 2026-10-22 #2

    Neue Updates von Red Hat aufgenommen

12. 2026-10-21 #1

    Initiale Fassung

References

• Red Hat Security Advisory RHSA-2026:87004 vom 2026-10-21
  https://access.redhat.com/errata/RHSA-2026:87004
• Red Hat Security Advisory RHSA-2026:87124 vom 2026-10-21
  https://access.redhat.com/errata/RHSA-2026:87124
• Red Hat Security Advisory RHSA-2026:88198 vom 2026-10-22
  https://access.redhat.com/errata/RHSA-2026:88198
• openSUSE Security Update OPENSUSE-SU-2026:12119-1 vom 2026-10-24
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/22AIEMITRD7HXU4LNR3JE7NZD22NTNVK/
• Red Hat Security Advisory RHSA-2026:90440 vom 2026-10-26
  https://access.redhat.com/errata/RHSA-2026:90440
• SUSE Security Update SUSE-SU-2026:24377-1 vom 2026-10-27
  https://lists.suse.com/pipermail/sle-security-updates/2026-October/030156.html
• Red Hat Security Advisory RHSA-2026:92452 vom 2026-10-29
  https://access.redhat.com/errata/RHSA-2026:92452
• Debian Security Advisory DSA-6594 vom 2026-10-29
  https://lists.debian.org/debian-security-announce/2026/msg00513.html
• Debian Security Advisory DSA-6594 vom 2026-10-29
  https://security-tracker.debian.org/tracker/DSA-6594-1
• Red Hat Security Advisory RHSA-2026:92584 vom 2026-10-29
  https://access.redhat.com/errata/RHSA-2026:92584
• Red Hat Security Advisory RHSA-2026:92588 vom 2026-10-29
  https://access.redhat.com/errata/RHSA-2026:92588
• Red Hat Security Advisory RHSA-2026:92666 vom 2026-10-29
  https://access.redhat.com/errata/RHSA-2026:92666
• Red Hat Security Advisory RHSA-2026:92449 vom 2026-10-29
  https://access.redhat.com/errata/RHSA-2026:92449
• Red Hat Security Advisory RHSA-2026:92566 vom 2026-10-29
  https://access.redhat.com/errata/RHSA-2026:92566
• Red Hat Security Advisory RHSA-2026:92578 vom 2026-10-29
  https://access.redhat.com/errata/RHSA-2026:92578
• Red Hat Security Advisory RHSA-2026:92583 vom 2026-10-29
  https://access.redhat.com/errata/RHSA-2026:92583
• Red Hat Security Advisory RHSA-2026:92574 vom 2026-10-29
  https://access.redhat.com/errata/RHSA-2026:92574
• Red Hat Security Advisory RHSA-2026:92667 vom 2026-10-29
  https://access.redhat.com/errata/RHSA-2026:92667
• IBM Security Bulletin 7295132 vom 2026-11-02
  https://www.ibm.com/support/pages/node/7295132
• Red Hat Security Advisory RHSA-2026:94501 vom 2026-11-03
  https://access.redhat.com/errata/RHSA-2026:94501
• Red Hat Security Advisory RHSA-2026:94500 vom 2026-11-03
  https://access.redhat.com/errata/RHSA-2026:94500
• Rocky Linux Security Advisory RLSA-2026:94500 vom 2026-11-04
  https://errata.build.resf.org/RLSA-2026:94500
• Red Hat Security Advisory RHSA-2026:94523 vom 2026-11-03
  https://access.redhat.com/errata/RHSA-2026:94523
• Red Hat Security Advisory RHSA-2026:94557 vom 2026-11-03
  https://access.redhat.com/errata/RHSA-2026:94557
• Rocky Linux Security Advisory RLSA-2026:94501 vom 2026-11-04
  https://errata.build.resf.org/RLSA-2026:94501
• Red Hat Security Advisory RHSA-2026:94634 vom 2026-11-03
  https://access.redhat.com/errata/RHSA-2026:94634
• Red Hat Security Advisory RHSA-2026:95012 vom 2026-11-04
  https://access.redhat.com/errata/RHSA-2026:95012
• Red Hat Security Advisory RHSA-2026:94631 vom 2026-11-03
  https://access.redhat.com/errata/RHSA-2026:94631
• Red Hat Security Advisory RHSA-2026:95267 vom 2026-11-04
  https://access.redhat.com/errata/RHSA-2026:95267
• Red Hat Security Advisory RHSA-2026:95360 vom 2026-11-04
  https://access.redhat.com/errata/RHSA-2026:95360
• Oracle Linux Security Advisory ELSA-2026-94500 vom 2026-11-04
  https://oss.oracle.com/pipermail/el-errata/2026-November/022794.html
• Oracle Linux Security Advisory ELSA-2026-94501 vom 2026-11-04
  https://oss.oracle.com/pipermail/el-errata/2026-November/022783.html
• Red Hat Security Advisory RHSA-2026:95365 vom 2026-11-05
  https://access.redhat.com/errata/RHSA-2026:95365
• Red Hat Security Advisory RHSA-2026:95261 vom 2026-11-04
  https://access.redhat.com/errata/RHSA-2026:95261
• Red Hat Security Advisory RHSA-2026:96406 vom 2026-11-09
  https://access.redhat.com/errata/RHSA-2026:96406
• Red Hat Security Advisory RHSA-2026:96400 vom 2026-11-09
  https://access.redhat.com/errata/RHSA-2026:96400
• Red Hat Security Advisory RHSA-2026:96403 vom 2026-11-09
  https://access.redhat.com/errata/RHSA-2026:96403
• Red Hat Security Advisory RHSA-2026:98126 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:98126
• IBM Security Bulletin 7296252 vom 2026-11-11
  https://www.ibm.com/support/pages/node/7296252
• Red Hat Security Advisory RHSA-2026:98503 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:98503
• Red Hat Security Advisory RHSA-2026:99022 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:99022
• Red Hat Security Advisory RHSA-2026:99024 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:99024
• Red Hat Security Advisory RHSA-2026:99025 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:99025
• Red Hat Security Advisory RHSA-2026:99021 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:99021
• Red Hat Security Advisory RHSA-2026:99026 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:99026
• Red Hat Security Advisory RHSA-2026:98612 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:98612
• Red Hat Security Advisory RHSA-2026:99023 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:99023
• Red Hat Security Advisory RHSA-2026:99027 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:99027
• Red Hat Security Advisory RHSA-2026:99019 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:99019
• Red Hat Security Advisory RHSA-2026:99793 vom 2026-11-12
  https://access.redhat.com/errata/RHSA-2026:99793
• Red Hat Security Advisory RHSA-2026:99795 vom 2026-11-12
  https://access.redhat.com/errata/RHSA-2026:99795
• Red Hat Security Advisory RHSA-2026:99952 vom 2026-11-13
  https://access.redhat.com/errata/RHSA-2026:99952
• Red Hat Security Advisory RHSA-2026:99949 vom 2026-11-13
  https://access.redhat.com/errata/RHSA-2026:99949
• Red Hat Security Advisory RHSA-2026:99950 vom 2026-11-13
  https://access.redhat.com/errata/RHSA-2026:99950
• Red Hat Security Advisory RHSA-2026:99818 vom 2026-11-12
  https://access.redhat.com/errata/RHSA-2026:99818
• Red Hat Security Advisory RHSA-2026:99815 vom 2026-11-12
  https://access.redhat.com/errata/RHSA-2026:99815
• Red Hat Security Advisory RHSA-2026:99814 vom 2026-11-12
  https://access.redhat.com/errata/RHSA-2026:99814
• Red Hat Security Advisory RHSA-2026:99813 vom 2026-11-12
  https://access.redhat.com/errata/RHSA-2026:99813
• Red Hat Security Advisory RHSA-2026:99810 vom 2026-11-12
  https://access.redhat.com/errata/RHSA-2026:99810
• Red Hat Security Advisory RHSA-2026:99809 vom 2026-11-12
  https://access.redhat.com/errata/RHSA-2026:99809
• Red Hat Security Advisory RHSA-2026:99807 vom 2026-11-12
  https://access.redhat.com/errata/RHSA-2026:99807
• Red Hat Security Advisory RHSA-2026:99799 vom 2026-11-12
  https://access.redhat.com/errata/RHSA-2026:99799
• Red Hat Security Advisory RHSA-2026:99798 vom 2026-11-12
  https://access.redhat.com/errata/RHSA-2026:99798
• Red Hat Security Advisory RHSA-2026:99797 vom 2026-11-12
  https://access.redhat.com/errata/RHSA-2026:99797
• Red Hat Security Advisory RHSA-2026:99782 vom 2026-11-12
  https://access.redhat.com/errata/RHSA-2026:99782
• Red Hat Security Advisory RHSA-2026:99786 vom 2026-11-12
  https://access.redhat.com/errata/RHSA-2026:99786
• Red Hat Security Advisory RHSA-2026:99790 vom 2026-11-12
  https://access.redhat.com/errata/RHSA-2026:99790
• Red Hat Security Advisory RHSA-2026:99791 vom 2026-11-12
  https://access.redhat.com/errata/RHSA-2026:99791
• Red Hat Security Advisory RHSA-2026:99788 vom 2026-11-12
  https://access.redhat.com/errata/RHSA-2026:99788