Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Container Release Update

🔗 CVE IDs covered (1)

📋 Description

🎯 Affected products7

• Red Hat Ansible Automation Platform 2.7
• registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b_arm64 as a component of Red Hat Ansible Automation Platform 2.7
• registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08_amd64 as a component of Red Hat Ansible Automation Platform 2.7
• registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5_amd64 as a component of Red Hat Ansible Automation Platform 2.7
• registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:fe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb_arm64 as a component of Red Hat Ansible Automation Platform 2.7
• registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2_amd64 as a component of Red Hat Ansible Automation Platform 2.7
• registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:edbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7_amd64 as a component of Red Hat Ansible Automation Platform 2.7

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.7#Upgrade Workaround: Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes. If custom middleware is present, it should be updated to use `request.scope["path"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target.

🔗 References (5)

• selfhttps://access.redhat.com/errata/RHSA-2026:23346
• externalhttps://access.redhat.com/security/cve/CVE-2026-48710
• externalhttps://access.redhat.com/security/updates/classification/
• externalhttps://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.7/whats_new-async_updates
• selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_23346.json