# CVE-2026-52902: Ansible awxkit path traversal in YAML !include directive

Source: https://junglewise.ai/threats/cve-2026-52902-ansible-awxkit-path-traversal-in-yaml-include-directive  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-52902 · Severity: medium · CVSS 4.7 · Published 2026-06-09

awxkit is a command-line tool used to interact with Ansible AWX, a platform for managing automation. A security flaw allows a malicious YAML configuration file to trick the tool into reading other sensitive files from the user's computer. If an administrator is convinced to import a specially crafted file, their private data could be uploaded to the AWX server and exposed to unauthorized parties.

Vendors: [Ansible](https://junglewise.ai/threats/vendors/ansible), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-52902 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52902 being exploited in the wild.

**How severe is CVE-2026-52902?** Medium severity, with a CVSS score of 4.7, published 9 June 2026.

**Which products and versions are affected?** awxkit (PyPI) <= 24.6.1, ECOSYSTEM:introduced=0,last_affected=24.6.1.

**Is there a fix for CVE-2026-52902?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-52902 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-52902?** Check whether you run Ansible AWX Kit or awxkit (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the YAML !include directive within awxkit. The extractFile() function in 'awxkit/yaml_file.py' uses os.path.join() with unsanitized user-controlled input from !include tags without performing path containment checks. An attacker can exploit this by providing a malicious YAML file to a user who then executes 'awx --conf.format yaml import'. This allows the attacker to read arbitrary YAML-formatted files from the local filesystem, which are then populated into AWX resource fields and potentially exposed via the AWX API or UI. The attack is limited to YAML-formatted files and requires local user interaction.

## Affected products

- Ansible awxkit <= 24.6.1
- Red Hat Red Hat Ansible Automation Platform 2

## Identifiers

- CVE-2026-52902
- GHSA-g29c-rgq6-gxgj
- PYSEC-2026-3550

## Timeline

- 2026-06-09: disclosed
- 2026-06-09: advisory

## References

- [https://access.redhat.com/security/cve/CVE-2026-52902](https://access.redhat.com/security/cve/CVE-2026-52902)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2486729](https://bugzilla.redhat.com/show_bug.cgi?id=2486729)