Is CVE-2026-52902 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52902 being exploited in the wild.

How severe is CVE-2026-52902?

Medium severity, with a CVSS score of 4.7, published 9 June 2026.

Which products and versions are affected?

awxkit (PyPI) <= 24.6.1, ECOSYSTEM:introduced=0,last_affected=24.6.1.

Is there a fix for CVE-2026-52902?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-52902 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-52902?

Check whether you run Ansible AWX Kit or awxkit (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52902: Ansible awxkit path traversal in YAML !include directive

Q: Which products and versions are affected?

awxkit (PyPI) <= 24.6.1, ECOSYSTEM:introduced=0,last_affected=24.6.1.

Q: Is there a fix for CVE-2026-52902?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-52902 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-52902?

Check whether you run Ansible AWX Kit or awxkit (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52902 · Severity: medium · CVSS 4.7 · Published 2026-06-09

awxkit is a command-line tool used to interact with Ansible AWX, a platform for managing automation. A security flaw allows a malicious YAML configuration file to trick the tool into reading other sensitive files from the user's computer. If an administrator is convinced to import a specially crafted file, their private data could be uploaded to the AWX server and exposed to unauthorized parties.

Vendors: Ansible, PyPI.

Quick answers

Is CVE-2026-52902 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52902 being exploited in the wild.
How severe is CVE-2026-52902?: Medium severity, with a CVSS score of 4.7, published 9 June 2026.
Which products and versions are affected?: awxkit (PyPI) <= 24.6.1, ECOSYSTEM:introduced=0,last_affected=24.6.1.
Is there a fix for CVE-2026-52902?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-52902 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-52902?: Check whether you run Ansible AWX Kit or awxkit (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in the YAML !include directive within awxkit. The extractFile() function in 'awxkit/yaml_file.py' uses os.path.join() with unsanitized user-controlled input from !include tags without performing path containment checks. An attacker can exploit this by providing a malicious YAML file to a user who then executes 'awx --conf.format yaml import'. This allows the attacker to read arbitrary YAML-formatted files from the local filesystem, which are then populated into AWX resource fields and potentially exposed via the AWX API or UI. The attack is limited to YAML-formatted files and requires local user interaction.

Affected products

Ansible awxkit <= 24.6.1
Red Hat Red Hat Ansible Automation Platform 2

Identifiers

CVE-2026-52902
GHSA-g29c-rgq6-gxgj
PYSEC-2026-3550

Timeline

2026-06-09: disclosed
2026-06-09: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.