Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Red Hat Ansible Automation Platform 2.5 may let attackers run code

published 25 days ago
Summary

Several components of Red Hat Ansible Automation Platform 2.5, including the automation controller, receptor, gateway proxy, gateway server, and a Python library, contain a coding error that could let an attacker execute commands on the system. This could lead to unauthorized access or manipulation of your automation environment. Apply the Red Hat security update as soon as possible to close the gap.

What to do
  • Update redhat automation-controller-venv-tower to version 0:4.6.33-1.el8ap.
  • Update redhat automation-controller-venv-tower to version 0:4.6.33-1.el9ap.
  • Update redhat receptor to version 0:1.6.8-1.el8ap.
  • Update redhat automation-gateway-proxy-server to version 0:2.5.10-8.el8ap.
  • Update redhat receptor to version 0:1.6.8-1.el9ap.
  • Update redhat automation-gateway-proxy-server to version 0:2.6.17-3.el9ap.
  • Update redhat python3.12-sqlparse to version 0:0.6.0-1.el8ap.
  • Update redhat python3.12-sqlparse to version 0:0.6.0-1.el9ap.
  • Update redhat automation-gateway-server to version 0:2.5.20260923-1.el8ap.
  • Update redhat automation-gateway-server to version 0:2.5.20260923-1.el9ap.
  • Update redhat python3.12-gitpython to version 0:3.1.60-1.el8ap.
  • Update redhat python3.12-gitpython to version 0:3.1.60-1.el9ap.
Affected software
Ecosystem VendorProductAffected versions
Red Hat:ansible_automation_platform:2.5::el8 redhat automation-controller-venv-tower < 0:4.6.33-1.el8ap
Fix: upgrade to 0:4.6.33-1.el8ap
Red Hat:ansible_automation_platform:2.5::el9 redhat automation-controller-venv-tower < 0:4.6.33-1.el9ap
Fix: upgrade to 0:4.6.33-1.el9ap
Red Hat:ansible_automation_platform_developer:2.5::el8 redhat receptor < 0:1.6.8-1.el8ap
Fix: upgrade to 0:1.6.8-1.el8ap
Red Hat:ansible_automation_platform_inside:2.5::el8 redhat receptor < 0:1.6.8-1.el8ap
Fix: upgrade to 0:1.6.8-1.el8ap
Red Hat:ansible_automation_platform:2.5::el8 redhat automation-gateway-proxy-server < 0:2.5.10-8.el8ap
Fix: upgrade to 0:2.5.10-8.el8ap
Red Hat:ansible_automation_platform:2.5::el8 redhat receptor < 0:1.6.8-1.el8ap
Fix: upgrade to 0:1.6.8-1.el8ap
Red Hat:ansible_automation_platform_developer:2.5::el9 redhat receptor < 0:1.6.8-1.el9ap
Fix: upgrade to 0:1.6.8-1.el9ap
Red Hat:ansible_automation_platform_inside:2.5::el9 redhat receptor < 0:1.6.8-1.el9ap
Fix: upgrade to 0:1.6.8-1.el9ap
Red Hat:ansible_automation_platform:2.5::el9 redhat automation-gateway-proxy-server < 0:2.6.17-3.el9ap
Fix: upgrade to 0:2.6.17-3.el9ap
Red Hat:ansible_automation_platform:2.5::el9 redhat receptor < 0:1.6.8-1.el9ap
Fix: upgrade to 0:1.6.8-1.el9ap
Red Hat:ansible_automation_platform_developer:2.5::el8 redhat python3.12-sqlparse < 0:0.6.0-1.el8ap
Fix: upgrade to 0:0.6.0-1.el8ap
Red Hat:ansible_automation_platform:2.5::el8 redhat python3.12-sqlparse < 0:0.6.0-1.el8ap
Fix: upgrade to 0:0.6.0-1.el8ap
Red Hat:ansible_automation_platform_developer:2.5::el9 redhat python3.12-sqlparse < 0:0.6.0-1.el9ap
Fix: upgrade to 0:0.6.0-1.el9ap
Red Hat:ansible_automation_platform:2.5::el9 redhat python3.12-sqlparse < 0:0.6.0-1.el9ap
Fix: upgrade to 0:0.6.0-1.el9ap
Red Hat:ansible_automation_platform:2.5::el8 redhat automation-gateway-server < 0:2.5.20260923-1.el8ap
Fix: upgrade to 0:2.5.20260923-1.el8ap
Red Hat:ansible_automation_platform:2.5::el9 redhat automation-gateway-server < 0:2.5.20260923-1.el9ap
Fix: upgrade to 0:2.5.20260923-1.el9ap
Red Hat:ansible_automation_platform:2.5::el8 redhat python3.12-gitpython < 0:3.1.60-1.el8ap
Fix: upgrade to 0:3.1.60-1.el8ap
Red Hat:ansible_automation_platform:2.5::el9 redhat python3.12-gitpython < 0:3.1.60-1.el9ap
Fix: upgrade to 0:3.1.60-1.el9ap
Original advisory text
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.9 Critical
Timeline
Published24 Sep 2026
Updated24 Sep 2026
First seen24 Sep 2026
Sources
Track software like this
Free during beta