CVE-2026-125063: Red Hat Ansible Automation Platform automation controller ReDoS in rrule validation

CVE-2026-125063 · Severity: medium · CVSS 4.3 · Published 2026-11-09

Red Hat Ansible Automation Platform's automation controller validates schedule recurrence rules (rrule) using inefficient regular expressions that can be exploited by authenticated users. By submitting specially crafted malformed rrule values through the REST API, an attacker can cause the validation logic to consume excessive CPU resources, exhausting the web worker pool and denying service to all legitimate API and web UI users until the attack stops.

Vendors: Red Hat.

Quick answers

Is CVE-2026-125063 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-125063 being exploited in the wild.
How severe is CVE-2026-125063?
Medium severity, with a CVSS score of 4.3, published 9 November 2026.
Which products and versions are affected?
Red Hat Ansible Automation Platform automation controller.
Is there a fix for CVE-2026-125063?
No fixed version is recorded yet. Limit API access to trusted users, as the schedule preview endpoint cannot be restricted by role-based access controls. Red Hat recommends replacing non-anchored wildcard regex patterns with anchored patterns, parsing the rrule value once instead of rescanning for each check, and capping accepted rrule length at the serializer field before validation runs. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-125063 attacked?
It is attacked over the network.
Am I affected by CVE-2026-125063?
Check whether you run Red Hat Ansible Automation Platform automation-controller. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Limit API access to trusted users, as the schedule preview endpoint cannot be restricted by role-based access controls. Red Hat recommends replacing non-anchored wildcard regex patterns with anchored patterns, parsing the rrule value once instead of rescanning for each check, and capping accepted rrule length at the serializer field before validation runs.

Technical details

The vulnerability is a regular expression denial of service (ReDoS) caused by non-anchored, lazy wildcard-prefixed regex patterns applied to user-supplied rrule values. When expected DTSTART/RRULE tokens are absent, validation time grows quadratically with input length. An authenticated attacker can submit token-free rrule values via the schedule preview REST API endpoint (which requires no resource-level permissions) to cause synchronous validation in the API web worker, exhausting the worker pool and denying service.

Affected products

  • Red Hat Ansible Automation Platform automation controller

Timeline

  • 2026-11-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.