RHSA-2026:13545HighCVSS 9.1

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update

Published
May 4, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (25)

CVE-2026-32597 →CVE-2026-4800 →CVE-2026-4926 →CVE-2026-25679 →CVE-2026-27606 →CVE-2026-29074 →CVE-2026-31812 →CVE-2026-33810 →CVE-2025-69228 →CVE-2026-6266 →CVE-2026-24049 →CVE-2026-32280 →CVE-2026-33154 →CVE-2026-35029 →CVE-2026-35030 →CVE-2026-27137 →CVE-2025-68121 →CVE-2025-69227 →CVE-2026-12382 →CVE-2026-23490 →CVE-2026-26007 →CVE-2026-30922 →CVE-2026-32274 →CVE-2026-0598 →CVE-2026-27459 →

📋 Description

CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-69227 — aiohttp: aiohttp: Denial of Service via specially crafted POST request CVE-2025-69228 — aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request CVE-2026-0598 — ansible-lightspeed: Broken Object Level Authorization Leading to Cross-User AI Conversation Context Injection in Ansible Lightspeed API CVE-2026-4800 — lodash: lodash: Arbitrary code execution via untrusted input in template imports CVE-2026-4926 — path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions CVE-2026-6266 — aap-controller: aap-gateway: Account hijacking and unauthorized access via unverified email linking CVE-2026-12382 — aap-gateway: missing requestHeadersToRemove allows mTLS bypass via Subject header spoofing CVE-2026-23490 — pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID CVE-2026-24049 — wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-26007 — cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves CVE-2026-27137 — crypto/x509: Incorrect enforcement of email constraints in crypto/x509 CVE-2026-27459 — pyOpenSSL: DTLS cookie callback buffer overflow CVE-2026-27606 — rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability CVE-2026-29074 — svgo: SVGO: Denial of Service via XML entity expansion CVE-2026-30922 — pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion CVE-2026-31812 — quinn-proto: quinn-proto: Denial of Service via crafted QUIC Initial packet CVE-2026-32274 — black: Black: Arbitrary file writes from unsanitized user input in cache file name CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32597 — pyjwt: PyJWT accepts unknown crit header extensions (RFC 7515 §4.1.11 MUST violation) CVE-2026-33154 — dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection CVE-2026-33810 — crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-35029 — litellm: LiteLLM: Remote code execution and privilege escalation via unrestricted proxy configuration endpoint CVE-2026-35030 — litellm: LiteLLM: Authentication bypass and privilege escalation via OIDC userinfo cache key collision

🎯 Affected products115

  • Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:1879be3aafbece708fd6d586940f6db61e5effd235ffb236f107366004146a19_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:bf34af37cbbcc048dcbda9aa9bf873fbdf244f50840f09cb0e001c2d2ef355cd_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:c9596b4386a20a5e74b35550600fef3254fecae6138648cf11bc64a83da9efbf_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:ff00bd55d0eb26d87e03dcb98f3ab8c5bb6b1012d2a42486b8937e0b6dd4af9c_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-builder-rhel9@sha256:20ed55c20740e13ca1db2b4ff3eb481253db2810b70f824f181d2262d3ace126_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-builder-rhel9@sha256:78bb601708c89ce1faa58e980d1b423c4498e469e514f6e4b16c997d12370b52_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-builder-rhel9@sha256:bab7406571af3a01039fc6841ee853ea06d6dd7bf8019ccdb381a3ecdbc1dd79_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-builder-rhel9@sha256:ec4da4a38f9998fddde6f91a87529c4daa0e6c0a4919226bc4237ec6fadc11bb_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9@sha256:05384905447e5c2974eda5cb9866696246f00ae4db42fa6de0dcfe4a1e89f46c_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9@sha256:4ba84fa1e2e4ed841c46d1cbc59472b79ce35a2c135248c43c8b23916aed7942_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9@sha256:52fab2d0ae1d8e4d8c4b060e5fc350f33683f217a6c0532674010e73be9ff640_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9@sha256:ab51737c0258483311e4ede2b82fdb922c969524eaa7c45dfc48d3fdcaf520d8_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator@sha256:54b1efe54cdd3e2c87a82a348fd94ce523e78c5538293455672cf68aa378eda0_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator@sha256:5dcda98257c48961b90ac115bdccbc263da391ac74b3a2933d1b85b6bf4d80db_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator@sha256:682ff0ea64332671b1001fbbc480eb83fb9b708ad758c9e916eb36456d8e2d2f_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator@sha256:6adb734db3dba05e49bdb7419b3cb6dbd1fed880461ff0745a2ddca43d6ddab2_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9@sha256:4adc9ebce0716fe9b9f8c6b6604c5ab0481ce4c886b805f15476174d434a1912_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9@sha256:a83ccba93f9d43062eeb9fe6bdbee59c2e5e968088a36997fccbe0f82ebafdce_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9@sha256:ab4819ac35d6519172ed95800560c4e3214755cc1a08a7214ccb28486342b139_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9@sha256:dd2e7f8245c01fe31b1de0266ca06062ed70f4ea5dee49e4211bd2694c639235_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9@sha256:3c8aa59788c7f7b40df6925505514145ce0dbe65c00cab2e282026f3a6ab1da4_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9@sha256:3d1afcc994ba68650434a2026d7c1880f966bfcf8f29628c16e29c65060cff7a_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9@sha256:ab0da105ec388adec982fdf764ff04e190ddbca309c7a993690a6e121a893d43_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9@sha256:f264bf94eac8ccff912cf887a95344e2a34e7278c7c2c5601d58220d8a671ec6_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9@sha256:01a19f289323c271cbbbaab4212d5506d18d43f12f4466edfd0d103c2a3e9b7f_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9@sha256:5c76959f4673118d55a0db120fa66dd8b01b08fdb692ca0e38c5fe308a6a2b72_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9@sha256:9c8be5a5c68f895ea44edecc9753156c919d3b213313df29c147f0d07c21e1fb_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9@sha256:dd686595d1aadaffcf7bac93f62af54eea6bdfb22421c2dfa0f39c8c9b9acfa0_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9-operator@sha256:041000cc15cc318f722190a3f8e2f7cb93554cec331f366d974836755e067b51_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • +85 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this vulnerability, limit the use of multiple sequential optional groups in route patterns within applications that use `path-to-regexp`. Additionally, avoid directly passing user-controlled input as route patterns to prevent the generation of maliciously crafted regular expressions. Workaround: The following practices would help for avoiding exposure and mitigate this flaw: - Restrict network access to the non-mTLS EDA event stream route (/eda-event-streams/) at the firewall or load balancer level, allowing only trusted internal sources. - If mTLS-protected event streams are in use, ensure that only the /mtls/eda-event-streams/ route is accessible from untrusted networks. - Monitor EDA event stream activity for unexpected events_received counter increases that may indicate unauthorized event injection. - Review Envoy proxy logs for requests to the non-mTLS event stream route from unexpected source IPs. Workaround: To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes. Workaround: Limit network access to the LiteLLM service to trusted networks or hosts only. Implement firewall rules to restrict inbound connections to the LiteLLM service's port, ensuring that only authorized systems can reach the service. This reduces the exposure of the `/config/update` endpoint to unauthorized authenticated users. Workaround: To mitigate this issue, ensure that JWT authentication is not enabled in LiteLLM configurations. The vulnerability only manifests when `enable_jwt_auth` is set to `true`. If JWT authentication is not strictly required, disable it to prevent potential authentication bypass and privilege escalation. If this configuration is changed, a restart of the LiteLLM service may be required for the changes to take effect.

🔗 References (29)