Description
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | ansible-tower | Fixed in ansible-tower 3.8.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform 2 | ansible-runner +1 | 2.0.3-3.el8ap | RHSA-2022:0474, RHSA-2022:0460 |
Advisories 2
- RHSA-2022:0474 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.0 ansible-runner security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2022:0460 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.1 ansible-runner security update Red Hat Security Advisories (RHSA) · Nov 22, 2025