RHSA-2026:71115 - Security Advisory

Topic

An update is now available for Red Hat Ansible Automation Platform 2.4

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.

Security Fix(es):

• automation-controller: Privilege escalation via provisioning-callback host-match bypass (CVE-2026-84474)
• automation-controller: Instance-group privilege escalation via workflow job template copy (CVE-2026-84719)
• automation-controller: Arbitrary file read via Project scm_branch git argument injection (CVE-2026-84711)
• automation-controller: Privilege escalation via constructed inventory attachment (CVE-2026-84684)
• automation-controller: Instance-group privilege escalation via Schedule and workflow node attachment (CVE-2026-84638)
• automation-controller: Remote code execution via Project scm_url git argument injection (CVE-2026-84502)
• automation-controller: awx: Privilege escalation to OpenShift namespace via pod_spec_override injection in container groups (CVE-2026-75884)
• automation-controller: Kubernetes service account token exfiltration via HashiCorp Vault credential SSRF (CVE-2026-12564)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

For details about this release, refer to the release notes listed in the References section.

Solution

For details on how to apply this update, refer to Ansible Automation Platform documentation.

Affected Products

• Red Hat Ansible Automation Platform 2.4 for RHEL 9 x86_64
• Red Hat Ansible Automation Platform 2.4 for RHEL 9 s390x
• Red Hat Ansible Automation Platform 2.4 for RHEL 9 ppc64le
• Red Hat Ansible Automation Platform 2.4 for RHEL 9 aarch64
• Red Hat Ansible Automation Platform 2.4 for RHEL 8 x86_64
• Red Hat Ansible Automation Platform 2.4 for RHEL 8 s390x
• Red Hat Ansible Automation Platform 2.4 for RHEL 8 ppc64le
• Red Hat Ansible Automation Platform 2.4 for RHEL 8 aarch64
• Red Hat Ansible Developer 1.1 for RHEL 9 x86_64
• Red Hat Ansible Developer 1.1 for RHEL 9 s390x
• Red Hat Ansible Developer 1.1 for RHEL 9 ppc64le
• Red Hat Ansible Developer 1.1 for RHEL 9 aarch64
• Red Hat Ansible Developer 1.1 for RHEL 8 x86_64
• Red Hat Ansible Developer 1.1 for RHEL 8 s390x
• Red Hat Ansible Developer 1.1 for RHEL 8 ppc64le
• Red Hat Ansible Developer 1.1 for RHEL 8 aarch64

Fixes

• BZ - 2490556 - CVE-2026-12564 Automation-Controller: automation-controller: Kubernetes service account token exfiltration via HashiCorp Vault credential SSRF
• BZ - 2517893 - CVE-2026-75884 awx: awx: Privilege escalation to OpenShift namespace via pod_spec_override injection in container groups
• BZ - 2527073 - CVE-2026-84474 automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and X-Forwarded-For spoofing of provisioning-callback host match
• BZ - 2527096 - CVE-2026-84502 automation-controller: automation-controller-container: automation-controller: Project scm_url argument injection into `git ls-remote --upload-pack` yields RCE on the controller-task control-plane pod
• BZ - 2527100 - CVE-2026-84638 automation-controller: automation-controller-container: automation-controller: instance group attachment to schedules and workflow job template nodes checks only read permission, allowing use of restricted (controlplane / other-tenant) ...
• BZ - 2527139 - CVE-2026-84684 automation-controller: automation-controller-container: automation-controller: constructed inventory input inventory attachment checks only read permission on the source inventory, allowing a read-only user to clone another tenant's hos ...
• BZ - 2527195 - CVE-2026-84711 automation-controller: automation-controller: Project scm_branch/scm_refspec argument injection into git during project sync allows arbitrary file read on the sync host (control-plane ServiceAccount token, SECRET_KEY, and DB credentials ...
• BZ - 2527213 - CVE-2026-84719 automation-controller: automation-controller: WorkflowJobTemplate /copy/ deep-copy sanitizer omits instance_groups authorization (InstanceGroup use_role bypass to control-plane)

CVEs

• CVE-2026-12564
• CVE-2026-75884
• CVE-2026-84474
• CVE-2026-84502
• CVE-2026-84638
• CVE-2026-84684
• CVE-2026-84711
• CVE-2026-84719

References

• https://access.redhat.com/security/updates/classification/#critical
• https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.4/html/red_hat_ansible_automation_platform_release_notes/asynchronous_updates
• https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.4#Installation%20and%20upgrade