Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8

• CVE-2026-84719 Critical 9.9 Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane) 0.5%
• CVE-2026-75884 Critical 9.1 Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups 0.4%
• CVE-2026-84502 Critical 9.9 Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane pod 0.6%
• CVE-2026-84474 Critical 9.9 Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioning-callback host match 0.8%
• CVE-2026-12564 Critical 9.6 Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf 0.3%
• CVE-2025-2877 Medium 6.5 Event-driven-ansible: exposure inventory passwords in plain text when starting a rulebook activation with verbosity set to debug in eda 0.4%
• CVE-2024-9902 Medium 6.3 Ansible-core: ansible-core user may read/write unauthorized content 0.3%
• CVE-2024-8775 Medium 5.5 Ansible-core: exposure of sensitive information in ansible vault files due to improper logging 0.3%
• CVE-2024-6840 Medium 6.6 Automation-controller: gain access to the k8s api server via job execution with container group 0.4%
• CVE-2024-1657 High 8.1 Platform: insecure websocket used when interacting with eda server 0.4%
• CVE-2024-1394 High 7.5 Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads 1.5%
• CVE-2024-0690 Medium 5.0 Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration 0.3%
• CVE-2023-5115 Medium 6.3 Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files 1.0%
• CVE-2023-5764 High 7.1 Ansible: template injection 0.6%
• CVE-2023-5189 Medium 6.3 Hub: insecure galaxy-importer tarfile extraction 1.0%
• CVE-2023-3971 High 7.3 Controller: html injection in custom login info 0.8%
• CVE-2023-4380 Medium 6.3 Platform: token exposed at importing project 0.6%
• CVE-2023-4237 High 7.3 Platform: ec2_key module prints out the private key directly to the standard output 0.3%