Log in Start free

Vulnerability · Published Jun 9, 2026 · Assigned by redhat

CVE-2026-52902Awxkit: path traversal via yaml !include directive

Medium 4.7

In plain English

A medium-severity path traversal in Red Hat Ansible Automation Platform 2 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)0.1%top 97.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.format yaml import". This is a client-side vulnerability requiring user interaction.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIawxkitno fix listedGHSA-g29c-rgq6-gxgj
PyPIawxkitno fix listedPYSEC-2026-3550

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 see references
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 see references
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 see references
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 see references
Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 see references
Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 see references
Red Hat Red Hat Ansible Automation Platform 2.7 for RHEL 10 see references
Red Hat Red Hat Ansible Automation Platform 2.7 for RHEL 9 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

References