RHSA-2026:24766HighCVSS 7.5

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Container Release Update

Published
June 9, 2026
Last Modified
August 22, 2026

🔗 CVE IDs covered (4)

CVE-2025-62718 →CVE-2026-6321 →CVE-2026-34070 →CVE-2026-40895 →

📋 Description

CVE-2025-62718 — axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization CVE-2026-6321 — fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies CVE-2026-34070 — langchain: path traversal in legacy load_prompt functions in langchain-core CVE-2026-40895 — follow-redirects: follow-redirects: Information disclosure via cross-domain redirects

🎯 Affected products103

  • Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/aap-must-gather-rhel8@sha256:177f319214bb66b602f15bc1f383d0bcf03f5d6186fbaf8432ffcd84406e9136_arm64 as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/aap-must-gather-rhel8@sha256:587bc1fb5db5c9a379d30ee3d6f70874b536d486f0fffec69320883e61a0cb4d_amd64 as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/aap-must-gather-rhel8@sha256:7b314da4ff3517de2a7cd69841ae7af88992f0e2ead296b033e9391641254b09_ppc64le as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/aap-must-gather-rhel8@sha256:f1f542e246de6f145c6b5ae61098d269522f220ec011ed434afc15452367218c_s390x as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/ansible-builder-rhel8@sha256:227f09783943bbeb984a9c64c5e6ed533cc2091fd5db8fa62e2165e5db6bae53_s390x as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/ansible-builder-rhel8@sha256:556b05978fac9d3e590da57687cd24fbe202dea35fd90207f564e49fe61f0275_ppc64le as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/ansible-builder-rhel8@sha256:9903f1637f29080b3085dde53e1f3d29d2db45c40afc3536e29d867409db62a1_amd64 as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/ansible-builder-rhel8@sha256:ab906736d5a89f6190c6d4b94ef21413a0336864bb9d6c466356d3cad2a404cb_arm64 as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/ansible-dev-tools-rhel8@sha256:04d1c09ab5047f021c9aa0c6749bfb0497f91e45135d5692b918b32e55ecfec7_arm64 as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/ansible-dev-tools-rhel8@sha256:1fed62acf3605eaefa3a373a55e0dbf22d3482244c013b229c70cd2739e883ad_amd64 as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/ansible-dev-tools-rhel8@sha256:9bc6b2f00f99a44bd51b3536fa248f5114fd92dfda1cfb5b5e4aad47072276fe_s390x as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/ansible-dev-tools-rhel8@sha256:d5fa52d5d627395f311889cd05b45749ff3c49eb5273f603c7211e4772cef8a2_ppc64le as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/ansible-python-base-rhel8@sha256:4ca003a3710ededde59f10dfb49b029d18e843b97a9122b9c4e60cbbbcaa3eb3_s390x as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/ansible-python-base-rhel8@sha256:5082d45d771bf463340aff8482ccf02d1c02464814f91f7c5d756ad33888c380_amd64 as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/ansible-python-base-rhel8@sha256:75d260d79e877c21c96201e12b40bef15cd737ce965631de194eaa24a8b85119_ppc64le as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/ansible-python-base-rhel8@sha256:ed8abcef81c3dd11b156f4cc5a736a9d20a7e93f6d73a1b45bc9395eb6e79e6f_arm64 as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/ansible-python-toolkit-rhel8@sha256:29e7df3f96716e9580c56dcc8410a03ab5000aab5c3a9c99139bbb541c3093e4_arm64 as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/ansible-python-toolkit-rhel8@sha256:6dcb02bef9742f9251e755488645634a0c6b5eae54dfad04614ffb0a21a469e1_s390x as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/ansible-python-toolkit-rhel8@sha256:e4d7670748811d57ed19d9c5f07b36014ca71218ee1ae2d51e92741409c65eb0_ppc64le as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/ansible-python-toolkit-rhel8@sha256:ed722aa99f17d45481a24c175d6f3ab1488eb50e1d662e0c5d2e4938aab396bf_amd64 as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/controller-rhel8-operator@sha256:a6cbf8934c562bfbfb6e88eb7532a381482357e626f958b82f4cf6f7cc21a0e3_ppc64le as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/controller-rhel8-operator@sha256:b62845532c4cfe14b5729cc59e775b1281888d3b65683f9b67f8c8a947716749_amd64 as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/controller-rhel8-operator@sha256:bcb301046ee9f77c71b2b7dccaba7c7c69c8c08d48441b35b622489e7b1f63fd_arm64 as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/controller-rhel8-operator@sha256:bfabfdd9f6f068de00689a6f4400c9e3dd4db2ceceae449ede94cb30244d5454_s390x as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/controller-rhel8@sha256:437b1cc6fa5f7aa9b9103e997ff9add2c9f84653aa08bb68c930329b03328df0_ppc64le as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/controller-rhel8@sha256:75ae6153a26c1c9b1ac1c5e8e584b99e73b32645a9acd362ced23c4c24170a64_s390x as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/controller-rhel8@sha256:df73d3b4912eda868994e0f42f91aa12f0a2dec727f4ba021202bcb7c8b975c6_arm64 as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/controller-rhel8@sha256:f0321f8fdb547285c91cd3d8d055b75582806161bf71713cc6d08c3aa2b3c887_amd64 as a component of Red Hat Ansible Automation Platform 2.5
  • registry.redhat.io/ansible-automation-platform-25/de-minimal-rhel8@sha256:331df637d9a8b6bb30a5fa79538b77a0a720553cc99fb9ca24731d5484bd181e_arm64 as a component of Red Hat Ansible Automation Platform 2.5
  • +73 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: As described in the statement section, the vulnerable methods are legacy APIs and their use should be avoided. To mitigate this issue, the dumpd, dumps, load and loads methods from langchain_core.load should be used, as they supersede the legacy API and provide a more secure serialization model.

🔗 References (8)