Red hat ansible automation platform 2

This hub aggregates every CVE we track for Red hat ansible automation platform 2, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Red hat ansible automation platform 2.

• CVE-2026-84721Automation-controller: automation-controller: email notification backend allows ssrf via user-controlled smtp host/port (internal port-scan oracle, smtp password exfil)6.4Sep 23, 2026
• CVE-2026-84713Automation-controller: automation-controller: notification.recipients/subject/error lack prevent_search, allowing zero-privilege cross-tenant recovery of notification recipient secrets via filter oracle6.5Sep 23, 2026
• CVE-2026-85475Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote code execution in the control-plane rsyslog component7.2Sep 23, 2026
• CVE-2026-71461Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler4.3Sep 23, 2026
• CVE-2026-76648Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job template secret recovery8.5Sep 23, 2026
• CVE-2026-42784Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion7.4Sep 16, 2026
• CVE-2026-92091Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array5.9Sep 16, 2026
• CVE-2026-79699Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory4.4Sep 15, 2026
• CVE-2026-79705Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers4.5Sep 15, 2026
• CVE-2026-84185Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification5.9Sep 3, 2026
• CVE-2026-84232Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content5.4Sep 1, 2026
• CVE-2026-80179Jwcrypto: jwcrypto: denial of service via malformed jwe tokens5.9Aug 27, 2026
• CVE-2026-79717Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restriction6.4Aug 25, 2026
• CVE-2026-19730Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives4.2Aug 13, 2026
• CVE-2026-18141Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header8.2Jul 31, 2026