CVE Tools
Track your stack

Red Hat Ansible Automation Platform 2

58 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Red Hat Ansible Automation Platform 2, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.

Red Hat Ansible Automation Platform 2 CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Red Hat Ansible Automation Platform 2 CVEs per month
MonthCVEs
2024-120
2025-010
2025-021
2025-030
2025-040
2025-050
2025-060
2025-072
2025-080
2025-091
2025-100
2025-110
2025-120
2026-010
2026-021
2026-030
2026-042
2026-050
2026-066
2026-079
2026-083
2026-0913
2026-108
2026-114

Severity

How the 58 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical35%
  • High1628%
  • Medium3560%
  • Low47%

Latest CVEs

The 15 most recently published vulnerabilities affecting Red Hat Ansible Automation Platform 2.

  1. CVE-2026-123084Python-pulpcore: pulpcore: header content guard jq filter exposes the content-app environment6.5
  2. CVE-2026-84503Ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -> rce6.7
  3. CVE-2026-125063Automation-controller: automation-controller: quadratic regex in schedule rrule validation allows an authenticated user to exhaust api web workers (denial of service)4.3
  4. CVE-2026-123037Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)6.7
  5. CVE-2026-114236Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers3.3
  6. CVE-2026-109131Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)5.4
  7. CVE-2026-92982Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection8.5
  8. CVE-2026-89091Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution8.8
  9. CVE-2026-103869Pulp-ansible: bearer tokens are reused across remotes in a worker6.5
  10. CVE-2026-103868Pulp-container: registry credentials are reused across remotes in a worker6.5
  11. CVE-2026-106033Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter5.4
  12. CVE-2026-103754Ansible-runner: ansible-runner: path traversal and symlink escape in unstream_dir() allows file write outside the target directory5.9
  13. CVE-2026-90959Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft8.1
  14. CVE-2026-94416Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery6.8
  15. CVE-2026-84721Automation-controller: automation-controller: email notification backend allows ssrf via user-controlled smtp host/port (internal port-scan oracle, smtp password exfil)6.4

Product grouping is registry-driven, with AI assist and human review. How it works