RHSA-2026:13512: Red Hat Ansible Automation Platform Security Advisory (RCE/SSRF/DoS CVEs)

RHSA-2026:13512 - Security Advisory Summary Vulnerability Overview Advisory ID: RHSA-2026:13512 Release Date: 2026-05-04 Severity: Important Affected Products: Red Hat Ansible Automation Platform 2.5 Vulnerability Details: automation-controller: Account takeover and unauthorized access via unverified email links (CVE-2026-6266) automation-controller: PyJWT accepts unknown 'crit' header extensions (RFC 7515 §4.1.11 MUST violation) (CVE-2026-32597) automation-controller: Denial of service via malformed HTML-like sequences (CVE-2025-69534) automation-controller: Cryptographic subgroup attack due to missing subgroup validation (CVE-2026-26007) automation-gateway: Account takeover and unauthorized access via unverified email links (CVE-2026-6266) automation-gateway: Remote code execution via path traversal vulnerability (CVE-2026-27606) automation-gateway: Denial of service via XML entity expansion (CVE-2026-29074) automation-gateway: Denial of service via $data reference (CVE-2025-69873) automation-gateway-proxy: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) python312-django-ansible-base: Account takeover and unauthorized access via unverified email links (CVE-2026-6266) python312-markdown: Denial of service via malformed HTML-like sequences (CVE-2025-69534) python312-jwcrypto: Out-of-memory condition caused by crafted compressed JWE tokens (CVE-2026-39373) python312-pyasn1: pyasn1 is vulnerable to denial of service via unbounded recursion (CVE-2026-30922) python312-pyasn1: pyasn1 is vulnerable to out-of-memory condition caused by malformed RELATIVE-OID (CVE-2026-23490) python312-pyOpenSSL: DTLS cookie callback buffer overflow (CVE-2026-27459) receptor: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) Affected Products Red Hat Ansible Automation Platform 2.5 (for RHEL 9 x86_64, s390x, ppc64le, aarch64) Red Hat Ansible Inside 1.3 (for RHEL 9 x86_64, s390x, ppc64le, aarch64; RHEL 8 x86_64, s390x, ppc64le, aarch64) Red Hat Ansible Developer 1.2 (for RHEL 9 x86_64, ppc64le, aarch64; RHEL 8 x86_64, s390x, ppc64le, aarch64) Remediation Please refer to the Ansible Automation Platform documentation for details on applying updates. Reference links: Red Hat Ansible Automation Platform 2.5 Release Notes Red Hat Ansible Automation Platform 2.5 Upgrade Guide

Goal Reached Thanks to every supporter — we hit 100%!

RHSA-2026:13512: Red Hat Ansible Automation Platform Security Advisory (RCE/SSRF/DoS CVEs)

More from this source