Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat Ansible Automation Platform 2.4 may let attackers run code

published 25 days ago

Summary

The automation-controller-venv-tower component in Red Hat Ansible Automation Platform 2.4 can be tricked into executing unauthorized commands. This could let a malicious user take control of the automation system. Apply the latest Red Hat update to fix the issue.

What to do

Update redhat automation-controller-venv-tower to version 0:4.5.36-1.el8ap.
Update redhat automation-controller-venv-tower to version 0:4.5.36-1.el9ap.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:ansible_automation_platform:2.4::el8	redhat	automation-controller-venv-tower	< 0:4.5.36-1.el8ap Fix: upgrade to 0:4.5.36-1.el8ap
Red Hat:ansible_automation_platform:2.4::el9	redhat	automation-controller-venv-tower	< 0:4.5.36-1.el9ap Fix: upgrade to 0:4.5.36-1.el9ap

Original advisory text

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

References

https://access.redhat.com/errata/RHSA-2026:71115 Vendor Advisory
https://access.redhat.com/security/updates/classification/#critical Third Party Advisory
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.4... Third Party Advisory
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.4... Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2490556 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2517893 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2527073 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2527096 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2527100 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2527139 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2527195 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2527213 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71115.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-12564 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-12564 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-12564 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-75884 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-75884 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-75884 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-84474 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-84474 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-84474 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-84502 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-84502 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-84502 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-84638 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-84638 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-84638 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-84684 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-84684 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-84684 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-84711 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-84711 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-84711 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-84719 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-84719 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-84719 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

9.9 Critical

Timeline

Published24 Sep 2026

Updated24 Sep 2026

First seen24 Sep 2026

Sources

RHSA-2026:71115 · OSV

Track software like this

Free during beta