{"schema_version":1,"title":"Red Hat Ansible Automation Platform vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 33 vulnerabilities in Red Hat Ansible Automation Platform: 18 in the last 7 days and 24 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-94416, was published on 24 September 2026.","url":"https://junglewise.ai/threats/technologies/ansible-automation-platform-2","json_url":"https://junglewise.ai/threats/technologies/ansible-automation-platform-2.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/ansible-automation-platform-2","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":17,"all_time":33,"critical":4,"exploited":0,"last_7_days":18,"last_30_days":18,"last_90_days":24,"last_365_days":33},"latest":[{"cve":"CVE-2026-94416","cvss":6.8,"epss":0.0045,"slug":"cve-2026-94416-an-authorization-bypass-was-found-in-the-ansible-automation","title":"Red Hat Ansible Automation Platform authorization bypass in gateway","severity":"medium","exploited":false,"published_at":"2026-09-24T13:17:17.62+00:00","url":"https://junglewise.ai/threats/cve-2026-94416-an-authorization-bypass-was-found-in-the-ansible-automation"},{"cve":"CVE-2026-85475","cvss":7.2,"epss":0.0043,"slug":"cve-2026-85475-a-flaw-was-found-in-the-ansible-automation-platform-automation","title":"Red Hat Ansible Automation Platform controller command injection in rsyslog configuration","severity":"high","exploited":false,"published_at":"2026-09-23T20:17:19.343+00:00","url":"https://junglewise.ai/threats/cve-2026-85475-a-flaw-was-found-in-the-ansible-automation-platform-automation"},{"cve":"CVE-2026-84724","cvss":6.6,"epss":0.0029,"slug":"cve-2026-84724-an-argument-injection-flaw-was-found-in-the-ansible-automation","title":"Red Hat Ansible Automation Platform argument injection in system-job subsystem","severity":"medium","exploited":false,"published_at":"2026-09-23T20:17:19.033+00:00","url":"https://junglewise.ai/threats/cve-2026-84724-an-argument-injection-flaw-was-found-in-the-ansible-automation"},{"cve":"CVE-2026-84721","cvss":6.4,"epss":0.0017,"slug":"cve-2026-84721-a-server-side-request-forgery-flaw-was-found-in-the-ansible","title":"Red Hat Ansible Automation Platform server-side request forgery in email backend","severity":"medium","exploited":false,"published_at":"2026-09-23T20:17:18.89+00:00","url":"https://junglewise.ai/threats/cve-2026-84721-a-server-side-request-forgery-flaw-was-found-in-the-ansible"},{"cve":"CVE-2026-84720","cvss":6.5,"epss":0.0027,"slug":"cve-2026-84720-a-flaw-was-found-in-the-ansible-automation-platform-automation","title":"Red Hat Ansible Automation Platform controller information disclosure via database column filtering","severity":"medium","exploited":false,"published_at":"2026-09-23T20:17:18.753+00:00","url":"https://junglewise.ai/threats/cve-2026-84720-a-flaw-was-found-in-the-ansible-automation-platform-automation"},{"cve":"CVE-2026-84719","cvss":9.9,"epss":0.0043,"slug":"cve-2026-84719-a-flaw-was-found-in-the-ansible-automation-platform-automation","title":"Red Hat Ansible Automation Platform controller privilege escalation in WorkflowJobTemplate copy","severity":"critical","exploited":false,"published_at":"2026-09-23T20:17:18.617+00:00","url":"https://junglewise.ai/threats/cve-2026-84719-a-flaw-was-found-in-the-ansible-automation-platform-automation"},{"cve":"CVE-2026-84717","cvss":5.3,"epss":0.0034,"slug":"cve-2026-84717-a-flaw-was-found-in-the-ansible-automation-platform-automation","title":"Red Hat Ansible Automation Platform automation-controller webhook signature verification bypass","severity":"medium","exploited":false,"published_at":"2026-09-23T20:17:18.353+00:00","url":"https://junglewise.ai/threats/cve-2026-84717-a-flaw-was-found-in-the-ansible-automation-platform-automation"},{"cve":"CVE-2026-84714","cvss":7.1,"epss":0.0029,"slug":"cve-2026-84714-a-flaw-was-found-in-the-automation-controller-input-validation","title":"Red Hat Ansible Automation Platform Jinja injection in input validation","severity":"high","exploited":false,"published_at":"2026-09-23T20:17:18.083+00:00","url":"https://junglewise.ai/threats/cve-2026-84714-a-flaw-was-found-in-the-automation-controller-input-validation"},{"cve":"CVE-2026-84713","cvss":6.5,"epss":0.0031,"slug":"cve-2026-84713-a-flaw-was-found-in-the-automation-controller-notification","title":"Red Hat Ansible Automation Platform Controller information disclosure in notification subsystem","severity":"medium","exploited":false,"published_at":"2026-09-23T20:17:17.95+00:00","url":"https://junglewise.ai/threats/cve-2026-84713-a-flaw-was-found-in-the-automation-controller-notification"},{"cve":"CVE-2026-84712","cvss":5.3,"epss":0.0034,"slug":"cve-2026-84712-a-flaw-was-found-in-the-automation-controller-api-the","title":"Red Hat Ansible Automation Controller API information disclosure","severity":"medium","exploited":false,"published_at":"2026-09-23T20:17:17.817+00:00","url":"https://junglewise.ai/threats/cve-2026-84712-a-flaw-was-found-in-the-automation-controller-api-the"},{"cve":"CVE-2026-84691","cvss":8.7,"epss":0.002,"slug":"cve-2026-84691-a-flaw-was-found-in-red-hat-ansible-automation-platform-s","title":"Red Hat Ansible Automation Platform controller format string in API error logging","severity":"high","exploited":false,"published_at":"2026-09-23T20:17:17.537+00:00","url":"https://junglewise.ai/threats/cve-2026-84691-a-flaw-was-found-in-red-hat-ansible-automation-platform-s"},{"cve":"CVE-2026-84683","cvss":8.7,"epss":0.0026,"slug":"cve-2026-84683-a-flaw-was-found-in-red-hat-ansible-automation-platform-s","title":"Red Hat Ansible Automation Platform controller XSS via ANSI escape sequences","severity":"high","exploited":false,"published_at":"2026-09-23T20:17:17.403+00:00","url":"https://junglewise.ai/threats/cve-2026-84683-a-flaw-was-found-in-red-hat-ansible-automation-platform-s"},{"cve":"CVE-2026-84502","cvss":9.9,"epss":0.0062,"slug":"cve-2026-84502-a-flaw-was-found-in-red-hat-ansible-automation-platform-s","title":"Red Hat Ansible Automation Platform controller command injection in project scm_url","severity":"critical","exploited":false,"published_at":"2026-09-23T19:19:40.377+00:00","url":"https://junglewise.ai/threats/cve-2026-84502-a-flaw-was-found-in-red-hat-ansible-automation-platform-s"},{"cve":"CVE-2026-84499","cvss":7.7,"epss":0.0038,"slug":"cve-2026-84499-a-flaw-was-found-in-red-hat-ansible-automation-platform-s","title":"Red Hat Ansible Automation Platform password disclosure in survey validation","severity":"high","exploited":false,"published_at":"2026-09-23T19:19:40.233+00:00","url":"https://junglewise.ai/threats/cve-2026-84499-a-flaw-was-found-in-red-hat-ansible-automation-platform-s"},{"cve":"CVE-2026-84486","cvss":8.2,"epss":0.0052,"slug":"cve-2026-84486-a-flaw-was-found-in-red-hat-ansible-automation-platform-s","title":"Red Hat Ansible Automation Platform debug endpoints authentication bypass","severity":"high","exploited":false,"published_at":"2026-09-23T19:19:40.093+00:00","url":"https://junglewise.ai/threats/cve-2026-84486-a-flaw-was-found-in-red-hat-ansible-automation-platform-s"},{"cve":"CVE-2026-84474","cvss":9.9,"epss":0.008,"slug":"cve-2026-84474-a-flaw-was-found-in-red-hat-ansible-automation-platform-s","title":"Red Hat Ansible Automation Platform credential exposure and RCE","severity":"critical","exploited":false,"published_at":"2026-09-23T19:19:39.93+00:00","url":"https://junglewise.ai/threats/cve-2026-84474-a-flaw-was-found-in-red-hat-ansible-automation-platform-s"},{"cve":"CVE-2026-76648","cvss":8.5,"epss":0.0024,"slug":"cve-2026-76648-copyapiview-awx-awx-api-generics-py-873-sets-permission-classes","title":"Red Hat Ansible Automation Platform authorization bypass in CopyAPIView","severity":"high","exploited":false,"published_at":"2026-09-23T19:19:15.03+00:00","url":"https://junglewise.ai/threats/cve-2026-76648-copyapiview-awx-awx-api-generics-py-873-sets-permission-classes"},{"cve":"CVE-2026-71462","cvss":4.1,"epss":0.0026,"slug":"cve-2026-71462-stringlistpathfield-to-internal-value-calls-os-path-exists-on","title":"Red Hat Ansible Automation Platform path traversal information disclosure","severity":"medium","exploited":false,"published_at":"2026-09-23T19:19:03.09+00:00","url":"https://junglewise.ai/threats/cve-2026-71462-stringlistpathfield-to-internal-value-calls-os-path-exists-on"},{"cve":"CVE-2026-18141","cvss":8.2,"slug":"cve-2026-18141-red-hat-ansible-automation-platform-mtls-bypass-in-aap-gateway","title":"Red Hat Ansible Automation Platform mTLS bypass in aap-gateway","severity":"high","exploited":false,"published_at":"2026-07-31T16:17:05.387+00:00","url":"https://junglewise.ai/threats/cve-2026-18141-red-hat-ansible-automation-platform-mtls-bypass-in-aap-gateway"},{"cve":"CVE-2026-12383","cvss":7.5,"slug":"cve-2026-12383-red-hat-event-driven-ansible-auth-bypass-in","title":"Red Hat Event-Driven Ansible auth bypass in ExternalEventStreamViewSet","severity":"high","exploited":false,"published_at":"2026-07-27T19:17:14.82+00:00","url":"https://junglewise.ai/threats/cve-2026-12383-red-hat-event-driven-ansible-auth-bypass-in"},{"cve":"CVE-2026-44192","cvss":6.6,"slug":"cve-2026-44192-red-hat-ansible-lightspeed-path-traversal-in-mcp-server","title":"Red Hat Ansible Lightspeed path traversal in MCP server","severity":"medium","exploited":false,"published_at":"2026-07-22T12:18:00.063+00:00","url":"https://junglewise.ai/threats/cve-2026-44192-red-hat-ansible-lightspeed-path-traversal-in-mcp-server"},{"cve":"CVE-2026-44187","cvss":3.3,"slug":"cve-2026-44187-red-hat-ansible-lightspeed-plaintext-api-key-storage-in-vs-code","title":"Red Hat Ansible Lightspeed plaintext API key storage in VS Code extension","severity":"low","exploited":false,"published_at":"2026-07-22T12:17:59.69+00:00","url":"https://junglewise.ai/threats/cve-2026-44187-red-hat-ansible-lightspeed-plaintext-api-key-storage-in-vs-code"},{"cve":"CVE-2026-16544","cvss":6.5,"slug":"cve-2026-16544-red-hat-awx-missing-authorization-in-websocket-event-consumer","title":"Red Hat AWX missing authorization in websocket event consumer","severity":"medium","exploited":false,"published_at":"2026-07-22T12:17:10.48+00:00","url":"https://junglewise.ai/threats/cve-2026-16544-red-hat-awx-missing-authorization-in-websocket-event-consumer"},{"cve":"CVE-2026-12382","cvss":8.2,"slug":"cve-2026-12382-red-hat-ansible-automation-platform-mtls-bypass-in-aap-gateway","title":"Red Hat Ansible Automation Platform mTLS bypass in AAP Gateway","severity":"high","exploited":false,"published_at":"2026-07-15T18:16:44.307+00:00","url":"https://junglewise.ai/threats/cve-2026-12382-red-hat-ansible-automation-platform-mtls-bypass-in-aap-gateway"},{"cve":"CVE-2026-44289","cvss":7.5,"epss":0.0068,"slug":"cve-2026-44289-protobufjs-uncontrolled-recursion-in-protobuf-decoding","title":"protobufjs uncontrolled recursion in protobuf decoding","severity":"high","exploited":false,"published_at":"2026-05-13T16:16:55.713+00:00","url":"https://junglewise.ai/threats/cve-2026-44289-protobufjs-uncontrolled-recursion-in-protobuf-decoding"}],"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":3,"exploited":0,"vulnerabilities":18},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Red Hat Enterprise Linux 9","slug":"enterprise-linux-9","vulnerabilities":146,"url":"https://junglewise.ai/threats/technologies/enterprise-linux-9"},{"name":"Red Hat Enterprise Linux 10","slug":"enterprise-linux-10","vulnerabilities":140,"url":"https://junglewise.ai/threats/technologies/enterprise-linux-10"},{"name":"Red Hat Enterprise Linux 8","slug":"enterprise-linux-8","vulnerabilities":132,"url":"https://junglewise.ai/threats/technologies/enterprise-linux-8"},{"name":"Red Hat Enterprise Linux 7","slug":"enterprise-linux-7","vulnerabilities":68,"url":"https://junglewise.ai/threats/technologies/enterprise-linux-7"},{"name":"Red Hat Keycloak","slug":"red-hat-keycloak","vulnerabilities":61,"url":"https://junglewise.ai/threats/technologies/red-hat-keycloak"},{"name":"Red Hat Enterprise Linux 6","slug":"enterprise-linux-6","vulnerabilities":56,"url":"https://junglewise.ai/threats/technologies/enterprise-linux-6"},{"name":"Red Hat Build of Keycloak","slug":"red-hat-build-of-keycloak","vulnerabilities":54,"url":"https://junglewise.ai/threats/technologies/red-hat-build-of-keycloak"},{"name":"Red Hat Enterprise Linux AppStream","slug":"enterprise-linux-appstream","vulnerabilities":46,"url":"https://junglewise.ai/threats/technologies/enterprise-linux-appstream"},{"name":"Red Hat OpenShift Container Platform 4","slug":"openshift-container-platform-4","vulnerabilities":36,"url":"https://junglewise.ai/threats/technologies/openshift-container-platform-4"},{"name":"Red Hat Developer Hub","slug":"developer-hub","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/developer-hub"},{"name":"Red Hat Multicluster Global Hub","slug":"multicluster-global-hub","vulnerabilities":19,"url":"https://junglewise.ai/threats/technologies/multicluster-global-hub"},{"name":"Red Hat AI Inference Server","slug":"ai-inference-server","vulnerabilities":16,"url":"https://junglewise.ai/threats/technologies/ai-inference-server"}],"technology":{"hub":true,"name":"Red Hat Ansible Automation Platform","slug":"ansible-automation-platform-2","vendor":{"name":"Red Hat","slug":"red-hat","url":"https://junglewise.ai/threats/vendors/red-hat"},"aliases":["ansible-automation-platform-2-5-for-rhel-8","red-hat-ansible-automation-platform"],"category":"framework","homepage":"https://www.redhat.com/en/technologies/management/ansible","description":"An enterprise-grade automation suite for managing IT infrastructure, applications, and networks.","url":"https://junglewise.ai/threats/technologies/ansible-automation-platform-2"},"most_severe":[{"cve":"CVE-2026-84474","cvss":9.9,"epss":0.008,"slug":"cve-2026-84474-a-flaw-was-found-in-red-hat-ansible-automation-platform-s","title":"Red Hat Ansible Automation Platform credential exposure and RCE","severity":"critical","exploited":false,"published_at":"2026-09-23T19:19:39.93+00:00","url":"https://junglewise.ai/threats/cve-2026-84474-a-flaw-was-found-in-red-hat-ansible-automation-platform-s"},{"cve":"CVE-2026-84502","cvss":9.9,"epss":0.0062,"slug":"cve-2026-84502-a-flaw-was-found-in-red-hat-ansible-automation-platform-s","title":"Red Hat Ansible Automation Platform controller command injection in project scm_url","severity":"critical","exploited":false,"published_at":"2026-09-23T19:19:40.377+00:00","url":"https://junglewise.ai/threats/cve-2026-84502-a-flaw-was-found-in-red-hat-ansible-automation-platform-s"},{"cve":"CVE-2026-84719","cvss":9.9,"epss":0.0043,"slug":"cve-2026-84719-a-flaw-was-found-in-the-ansible-automation-platform-automation","title":"Red Hat Ansible Automation Platform controller privilege escalation in WorkflowJobTemplate copy","severity":"critical","exploited":false,"published_at":"2026-09-23T20:17:18.617+00:00","url":"https://junglewise.ai/threats/cve-2026-84719-a-flaw-was-found-in-the-ansible-automation-platform-automation"},{"cve":"CVE-2026-28802","cvss":9.8,"epss":0.0055,"slug":"cve-2026-28802-authlib-signature-verification-bypass-via-none-algorithm-in-jwt","title":"Authlib signature verification bypass via none algorithm in JWT","severity":"critical","exploited":false,"published_at":"2026-03-06T07:16:01.053+00:00","url":"https://junglewise.ai/threats/cve-2026-28802-authlib-signature-verification-bypass-via-none-algorithm-in-jwt"},{"cve":"CVE-2026-84683","cvss":8.7,"epss":0.0026,"slug":"cve-2026-84683-a-flaw-was-found-in-red-hat-ansible-automation-platform-s","title":"Red Hat Ansible Automation Platform controller XSS via ANSI escape sequences","severity":"high","exploited":false,"published_at":"2026-09-23T20:17:17.403+00:00","url":"https://junglewise.ai/threats/cve-2026-84683-a-flaw-was-found-in-red-hat-ansible-automation-platform-s"},{"cve":"CVE-2026-84691","cvss":8.7,"epss":0.002,"slug":"cve-2026-84691-a-flaw-was-found-in-red-hat-ansible-automation-platform-s","title":"Red Hat Ansible Automation Platform controller format string in API error logging","severity":"high","exploited":false,"published_at":"2026-09-23T20:17:17.537+00:00","url":"https://junglewise.ai/threats/cve-2026-84691-a-flaw-was-found-in-red-hat-ansible-automation-platform-s"},{"cve":"CVE-2026-24486","cvss":8.6,"epss":0.0224,"slug":"cve-2026-24486-kludex-python-multipart-path-traversal-in-file-upload-handler","title":"Kludex python-multipart path traversal in file upload handler","severity":"high","exploited":false,"published_at":"2026-01-27T01:16:02.303+00:00","url":"https://junglewise.ai/threats/cve-2026-24486-kludex-python-multipart-path-traversal-in-file-upload-handler"},{"cve":"CVE-2026-0847","cvss":8.6,"epss":0.009,"slug":"cve-2026-0847-nltk-path-traversal-in-corpusreader-classes","title":"NLTK path traversal in CorpusReader classes","severity":"high","exploited":false,"published_at":"2026-03-04T19:16:10.683+00:00","url":"https://junglewise.ai/threats/cve-2026-0847-nltk-path-traversal-in-corpusreader-classes"},{"cve":"CVE-2026-0846","cvss":8.6,"epss":0.0053,"slug":"cve-2026-0846-nltk-arbitrary-file-read-in-nltk-util-filestring","title":"NLTK arbitrary file read in nltk.util.filestring","severity":"high","exploited":false,"published_at":"2026-03-09T20:16:05.703+00:00","url":"https://junglewise.ai/threats/cve-2026-0846-nltk-arbitrary-file-read-in-nltk-util-filestring"},{"cve":"CVE-2026-76648","cvss":8.5,"epss":0.0024,"slug":"cve-2026-76648-copyapiview-awx-awx-api-generics-py-873-sets-permission-classes","title":"Red Hat Ansible Automation Platform authorization bypass in CopyAPIView","severity":"high","exploited":false,"published_at":"2026-09-23T19:19:15.03+00:00","url":"https://junglewise.ai/threats/cve-2026-76648-copyapiview-awx-awx-api-generics-py-873-sets-permission-classes"}],"generated_at":"2026-09-28T03:07:00.154823+00:00"}