RHSA-2026:50340HighCVSS 9.1

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Container Release Update

Published
August 4, 2026
Last Modified
August 14, 2026

🔗 CVE IDs covered (18)

CVE-2026-13149 →CVE-2026-55380 →CVE-2026-59197 →CVE-2026-59886 →CVE-2026-59939 →CVE-2026-11332 →CVE-2026-48526 →CVE-2026-54283 →CVE-2026-13676 →CVE-2026-40898 →CVE-2026-44545 →CVE-2026-48990 →CVE-2026-54058 →CVE-2026-54060 →CVE-2026-12383 →CVE-2026-18141 →CVE-2026-34993 →CVE-2026-55379 →

📋 Description

CVE-2026-11332 — ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution CVE-2026-12383 — eda-server: ExternalEventStreamViewSet trusts Subject header without validation and leaks expected DN CVE-2026-13149 — brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13676 — fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization CVE-2026-18141 — aap-gateway: aap-gateway: Authentication bypass in Event-Driven Ansible via forged HTTP header CVE-2026-34993 — aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() CVE-2026-40898 — github.com/quic-go/quic-go: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers CVE-2026-44545 — daphne: daphne: Denial of Service via excessive WebSocket message size CVE-2026-48526 — python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens CVE-2026-48990 — joserfc: joserfc: Resource exhaustion via oversized JSON Web Signature (JWS) payloads CVE-2026-54058 — Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image CVE-2026-54060 — python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files CVE-2026-54283 — starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS CVE-2026-55379 — python-pillow: Pillow: Denial of Service via crafted BDF font file CVE-2026-55380 — python-pillow: Pillow: Denial of Service via crafted GD 2.x image file CVE-2026-59197 — Pillow: Pillow: Native heap out-of-bounds write CVE-2026-59886 — pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values CVE-2026-59939 — httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies

🎯 Affected products63

  • Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/aap-must-gather-rhel9@sha256:af38581c04caff4c124a2a5cc0dbbc29a35d59136a72149c88341d5130ec115c_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/aap-must-gather-rhel9@sha256:fc4564a19e737e01f69a8ffc7f609cfc00cbe78ecbd0202e21580798e0fad5b0_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ansible-builder-rhel9@sha256:bad1cfd25c0a76284bca0d4e7b2997d1c19cf534a090c023818d7636c02b1d5a_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ansible-builder-rhel9@sha256:d997409acf678f6741759e71663564fce7f9dbf36ba9c3efa4095514c365c8f8_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ansible-dev-tools-rhel9@sha256:f66f5e6d6765f1e59a21da1f3ccb57c5c9d5a385b3a6ff359301e1dcbaf992d2_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ansible-dev-tools-rhel9@sha256:f7d315beff91d5327f4c3ec3a5d95db462723d0c177023eee11b168381153a2b_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ansible-devspaces-rhel9@sha256:5c57cc4b1591620c23e4d09d7452d560c344651f1c2a6559597b8a86901d7270_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ansible-devspaces-rhel9@sha256:dd6396d101bf72b073914a91fa8621114060b83a6398dbaceacf60e550370058_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/controller-rhel9-operator@sha256:5af18e0dfbddd146401125d1af25e02fbcd5c9c9c99f8b3463035ce8e8dfc88a_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/controller-rhel9-operator@sha256:d6ed231018aba445d42efaee38d156e3210029f914bcc7f41145c76063f179c6_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/controller-rhel9@sha256:49603d8eb1133ff25d77932418445b3399d56696b91575f404d54bd66f2abdf1_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/controller-rhel9@sha256:cb6992dd9e3b8ff0cd5a96c7d72c2bd543a3ca388fbf87efec36aa4f1c170fe4_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9@sha256:b08e64bb465fc4873e0822456a4b0bb3feb212f51f2629b751c5bf11b5952136_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9@sha256:f1a964f105f950060df297d60d49dadefadfc04a98e4196379e3c48590aabf5a_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/de-supported-rhel9@sha256:214c8d370aff0f8260169e1092e630dd28d6b332da142d055c97e6ed906bd5d2_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/de-supported-rhel9@sha256:603d5e810f3d05b36135d5155cea52d575dd6314354f42439c00c4d744a154ec_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9-operator@sha256:3a76538670407269fba45d8e9ba3c6b5067b6b19c4538fc837f3b167adf33de1_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9-operator@sha256:e07554775d76ffbfe312399cfa7469d444bcfb3486ff4d42ba64dc10d10c95b2_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9@sha256:0e5b8ea19aaf599851b6d3c33f157fed70d6889c21f3b7dda42cc0aaee45e40a_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9@sha256:665bc156c655ca4ed0021bffbabb1d2c7d0a5541582ea63287fcf7d2c3bbf89c_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/eda-controller-ui-rhel9@sha256:4087572ac03600b6516526a78d5b4b093c943a6fd0a120c892d58df2a3118881_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/eda-controller-ui-rhel9@sha256:4589dd9e21834c2d4f61712256d3e69b473fbe01c118c46e7c796c39715d3060_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9@sha256:1b29c33260a34d319581e3ad50436ba331ae2d1ff957c67184a253f084c86441_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9@sha256:4a3de7687c2f4014016918f800f8edc3727f58e10f91516e38e5a5a1a6aa60d1_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9@sha256:d0d43952f6566605feb98ecab51ebafb6a97f23fd7ecee8e1a88af6b495683f9_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9@sha256:fb1c1bdc24278bee7dfc433af498acac5fbc440ee919568254adb3ee9973f978_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ee-supported-rhel9@sha256:35caea9f2f5102fb4088201ba4a96a8c3eab4dfae0facf03ed2a58aeb0ce4549_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ee-supported-rhel9@sha256:bf55509be1d47b9f644c647f32bc3db8c618ae87a921aaac87003b420e0266d7_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/gateway-proxy-rhel9@sha256:6706769c9e9e74957c01991b8ebe5fbce625b39ba762af1ad9989f11df0b8cf6_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • +33 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.7#Upgrade Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: The following practices would help for avoiding exposure and mitigate this flaw: - Ensure the EDA server is not directly accessible from untrusted networks; all traffic should route through the AAP Gateway which should perform mTLS validation. - If possible, configure network-level access controls to restrict which source IPs can reach the EDA backend API. - Monitor EDA event streams for unexpected events_received counter changes. - Review and rotate mTLS client certificates if unauthorized access is suspected, as the expected DN may have been leaked via the 403 error response. Workaround: There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Restrict network access to the EDA event stream endpoints at the firewall or load balancer level. Ensure that only trusted sources are permitted to reach the event stream ports. Additionally, monitor EDA event logs for any unexpected events originating from unverified sources. Workaround: Applications using AIOHTTP that are configured to load untrusted files via the `CookieJar.load()` function should implement input sanitization prior to loading. This prevents the injection of malicious code. Workaround: The risk can be mitigated by rejecting oversized serialized JWS inputs before they reach joserfc and enforcing strict request/body size limits at the application or reverse-proxy layer. Workaround: Do not load BDF font files from untrusted sources. Applications that only process standard image formats (PNG, JPEG, etc.) and do not use BdfFontFile or ImageFont.load() with BDF files are not affected. Workaround: Avoid processing untrusted GD 2.x image files with PIL.GdImageFile.open(). Use Image.open() instead, which includes decompression bomb protections for supported formats. If GdImageFile must be used, validate the image dimensions before calling load(). Restricting accepted image formats at the application boundary to only those explicitly needed can reduce exposure. Workaround: When processing untrusted ASN.1 data with pyasn1, avoid calling prettyPrint(), str(), float(), int(), or performing comparisons or arithmetic on decoded Real (ASN.1 REAL type) objects. Instead, inspect the raw (mantissa, base, exponent) tuple directly. Where logging decoded ASN.1 structures is necessary, filter out or sanitize Real-typed values before conversion.

🔗 References (22)