Description
A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a victim's account or gain unauthorized access to other accounts, including administrative accounts, by manipulating the IDP-provided email.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | django-ansible-base | 2.5.0 – < 2.5.20260422, 2.6.0 – < 2.6.20260422 | 2.5.20260422 |
| — | automation-controller | 4.6.0 – < 4.6.28, 4.7.0 – < 4.7.11 | 4.6.28 |
| — | automation-gateway | 2.5.0 – < 2.5.20260422, 2.6.0 – < 2.6.20260422 | 2.5.20260422 |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform Inside 2 | receptor | 1.6.4-2.el8ap | RHSA-2026:13512, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform Inside 2 | receptorctl | 1.6.4-2.el9ap | RHSA-2026:13508 |
| Red Hat Ansible Automation Platform Developer 2 | automation-controller +1 | 4.7.11-2.el9ap | RHSA-2026:13508 |
| Red Hat Ansible Automation Platform Developer 2 | receptor | 1.6.4-2.el8ap | RHSA-2026:13512, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform Developer 2 | receptorctl | 1.6.4-2.el9ap | RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | automation-controller +3 | 4.7.11-2.el9ap | RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | automation-controller-venv-tower | 4.6.28-3.el8ap | RHSA-2026:13512, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy +1 | 2.5.10-5.el8ap | RHSA-2026:13512, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-server +11 | 2.5.20260422-2.el8ap | RHSA-2026:13512, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.8-1.el9ap | RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | python3.12-django-ansible-base+resource_registry | 2.6.20260422-1.el9ap | RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | python3.12-jwcrypto | 1.5.7-1.el8ap | RHSA-2026:13512, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | python3.12-markdown | 3.10.2-1.el8ap | RHSA-2026:13512, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | python3.12-pyOpenSSL | 26.0.0-1.el8ap | RHSA-2026:13512, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | python3.12-pyasn1 | 0.6.3-1.el8ap | RHSA-2026:13512, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | python3.12-pyjwt +1 | 2.12.1-1.el8ap | RHSA-2026:13512, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | receptor | 1.6.4-2.el8ap | RHSA-2026:13512, RHSA-2026:13508 |
| Red Hat Ansible Automation Platform 2 | receptorctl | 1.6.4-2.el9ap | RHSA-2026:13508 |
Advisories 2
- RHSA-2026:13512 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:13508 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
References
- RHSA-2026:13508 vendor-advisory
- RHSA-2026:13512 vendor-advisory
- RHSA-2026:13545 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-6266 vdb-entry
- RHBZ#2458142 issue-tracking