Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-09T07:17:10 awxkit: path traversal via YAML !include directive 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N CWE-22

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.format yaml import". This is a client-side vulnerability requiring user interaction.

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.format yaml import". This is a client-side vulnerability requiring user interaction.

awxkit as a bundled Python dependency found in ee-supported and platform-resource-runner containers for ansible-automation-platform and as part of the automation-controller RPM. Red Hat would like to thank FORIMOC, Yuremin, and invoke1442 for reporting this issue. The following practices would help for avoiding exposure to this flaw: 1) Prioritize the default JSON import format instead of YAML. 2) Avoid importing YAML files from untrusted sources. Red Hat Ansible Automation Platform 2.5 for RHEL 8 2026-08-24T00:00:00Z RHSA-2026:59135 automation-controller-0:4.6.32-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 2026-08-24T00:00:00Z RHSA-2026:59135 automation-controller-0:4.6.32-1.el9ap Red Hat Ansible Automation Platform 2.6 for RHEL 9 2026-08-24T00:00:00Z RHSA-2026:59136 automation-controller-0:4.7.16-1.el9ap Red Hat Ansible Automation Platform 2.7 for RHEL 10 2026-08-24T00:00:00Z RHSA-2026:59137 automation-controller-cli-0:4.8.6-1.el10ap Red Hat Ansible Automation Platform 2.7 for RHEL 9 2026-08-24T00:00:00Z RHSA-2026:59137 automation-controller-cli-0:4.8.6-1.el9ap Red Hat Ansible Automation Platform 2 Under investigation ansible-automation-platform-24/ee-supported-rhel8 Red Hat Ansible Automation Platform 2 Under investigation ansible-automation-platform-24/ee-supported-rhel9 Red Hat Ansible Automation Platform 2 Under investigation ansible-automation-platform-24/platform-resource-runner-rhel8 Red Hat Ansible Automation Platform 2 Under investigation ansible-automation-platform-25/ee-supported-rhel8 Red Hat Ansible Automation Platform 2 Under investigation ansible-automation-platform-25/ee-supported-rhel9 Red Hat Ansible Automation Platform 2 Under investigation ansible-automation-platform-25/platform-resource-runner-rhel8 Red Hat Ansible Automation Platform 2 Under investigation ansible-automation-platform-26/ee-supported-rhel9 Red Hat Ansible Automation Platform 2 Under investigation ansible-automation-platform-26/platform-resource-runner-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-27/ee-supported-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-27/platform-resource-runner-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-52902 https://nvd.nist.gov/vuln/detail/CVE-2026-52902