RHSA-2025:19221HighCVSS 8.8

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update

Published
October 28, 2025
Last Modified
August 25, 2026

🔗 CVE IDs covered (5)

CVE-2025-9908 →CVE-2025-58754 →CVE-2025-59343 →CVE-2025-59682 →CVE-2025-9907 →

📋 Description

CVE-2025-9907 — event-driven-ansible: Event Stream Test Mode Exposes Sensitive Headers in AAP EDA CVE-2025-9908 — event-driven-ansible: Sensitive Internal Headers Disclosure in AAP EDA Event Streams CVE-2025-58754 — axios: Axios DoS via lack of data size check CVE-2025-59343 — tar-fs: tar-fs symlink validation bypass CVE-2025-59682 — django: Potential partial directory-traversal via archive.extract()

🎯 Affected products103

  • Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:6234df5349999e20be07aa3c38010a3a65be0ee046773d1bca3514e208f3cf78_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:83d86c80c569a9f31196747e15d264bfc251a6674838bb6429a287d32a787459_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:c2df702889d1107e0e3af4af521e7a4e5f95e903e86841f1aa358c8dab9c60a1_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:cc7e50863e30c9d063e2a565d0c458731213d1207e350c7806f43034a858ae5b_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-builder-rhel9@sha256:815e697ac53fe170190a0d0cb7b97850b0d82e5e2922d3d26cb915c657cf1580_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-builder-rhel9@sha256:8fd2d13811182cef881debf6be72511b3c1bec13419b06227992870e4f73b08e_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-builder-rhel9@sha256:aacbd0924a893df085378cfe45a33b2ad7decf5d73ef92ee23c9781186736438_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-builder-rhel9@sha256:cc22ae64354f0e0339b863bd9e24f03bd94a55ae29361ddc7be944a713b66766_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9@sha256:533594cf53838ba60378f8e20fab01b26bf154219fcac7086aba05efbb0f2e5f_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9@sha256:58aecbcbd1ed707cceb107eae0c11c048c1840fcc5be1eae9172ab9a367e5a5d_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9@sha256:8c94a0beee5e82d7de3ab1f25b4c9d9419d04f8be965896f1ed8e12e00a1c4c9_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9@sha256:e777c309cb46685326bf61f6cb617e8f05b5f135fd3579f3fc403a8eef902246_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator@sha256:080a2749d8f069a561915ba788999a6d9a0d4641df282cf62168e63414ca0098_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator@sha256:bb921be10afe800a9670670965b9df554fc03fc32d6d6619a4d2f0e80f9c32dd_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator@sha256:c50352c97aeccabaa290f9a33436b59c83d0fabe9047585ed7dbd1f2e02976e9_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator@sha256:e2e6a5db64da900bb1f004f2beabd3bd578aa43a5d69051ee774918ab8d8950e_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9@sha256:0dc1770990eb18e29e4b5d0d6e31f76ea98b9bc553b4af38ba2fa419b260836b_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9@sha256:4a00012fedf458afc04d5a2c010027d3e482d9dabcb82f55d4cb479473f9d2d6_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9@sha256:703c8aa650afe52683e2d15e7f6fdfbd8fc9c4e35122fe0ef551bbc14b4675c1_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9@sha256:89dea5d275fba916d2d988ee6b5420ac3d0e198ec0195cdf5db818f7331eaea4_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9@sha256:06aa0cc29ecfe0adac0b42a4a3d8a73641d2d222e3d882af86f31b547223444d_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9@sha256:9513550a50f14bd48a45cbd2f493e79bd9b4416efb035d62699e176906c2a70e_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9@sha256:d34a73ba2e35682b4090373682112b5b15a232e217a13717a5dbe30ad6e0d524_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9@sha256:ee7252d8265f1530bb9ad5908f9b292d348275cdb3552306f9831eb8ad3c577f_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9@sha256:01b7617033de7cf8a24b35a098abd34185605ab879dba4f1bb5af5777d5060c5_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9@sha256:5195a7de6c4496dc134aac3095981534ccb352bd542c728a5d8bc86e87d5f681_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9@sha256:ac4600c8d66becc731d588b718d0e6651abcd4aedea4bfac384e52266542a129_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9@sha256:be9b91c9336638bfadfd88f9da08f3f343879a7d2023dd79952be9ab6882be09_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9-operator@sha256:1299a3e187dff4f23c8170e488bf5ecddd82b1de80126f4c2c919069b011f100_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • +73 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrading Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (8)