RHSA-2026:50479HighCVSS 9.1

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update

Published
August 4, 2026
Last Modified
August 14, 2026

🔗 CVE IDs covered (19)

CVE-2026-9595 →CVE-2026-11332 →CVE-2026-18141 →CVE-2026-44545 →CVE-2026-54058 →CVE-2026-55380 →CVE-2026-59939 →CVE-2026-8643 →CVE-2026-13149 →CVE-2026-13676 →CVE-2026-40898 →CVE-2026-48990 →CVE-2026-54060 →CVE-2026-54283 →CVE-2026-55379 →CVE-2026-34993 →CVE-2026-59197 →CVE-2026-59869 →CVE-2026-59886 →

📋 Description

CVE-2026-8643 — python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite CVE-2026-9595 — webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration CVE-2026-11332 — ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution CVE-2026-13149 — brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13676 — fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization CVE-2026-18141 — aap-gateway: aap-gateway: Authentication bypass in Event-Driven Ansible via forged HTTP header CVE-2026-34993 — aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() CVE-2026-40898 — github.com/quic-go/quic-go: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers CVE-2026-44545 — daphne: daphne: Denial of Service via excessive WebSocket message size CVE-2026-48990 — joserfc: joserfc: Resource exhaustion via oversized JSON Web Signature (JWS) payloads CVE-2026-54058 — Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image CVE-2026-54060 — python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files CVE-2026-54283 — starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS CVE-2026-55379 — python-pillow: Pillow: Denial of Service via crafted BDF font file CVE-2026-55380 — python-pillow: Pillow: Denial of Service via crafted GD 2.x image file CVE-2026-59197 — Pillow: Pillow: Native heap out-of-bounds write CVE-2026-59869 — js-yaml: js-yaml: Denial of Service via crafted YAML documents CVE-2026-59886 — pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values CVE-2026-59939 — httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies

🎯 Affected products119

  • Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:1e388383c5111049bb8f2d1f37fcee6773067152d256492f7e9db908d52b4652_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:6458f36f24c26733e1a052ce8a1beac8efed6da6574133103d8dc7b868e580b2_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:b1561aa0c5cdc34467541dddd7be145859c3d3d041989d483eb54a720a65ec26_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:dbaddb3974c4ca1a4f7e58b0a3d91ba7d2d946100cf55c6acd740a61ad2fb143_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-builder-rhel9@sha256:5049e7dd3ec73b82a0fdc7ba1f5c2ce7bfc4bfee023af24133d1c48eb2838d50_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-builder-rhel9@sha256:7c971a91ac52f6d5e8702548923890afb2aa586731c5092396d3e769516fb7ed_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-builder-rhel9@sha256:c4bc8ce6d217e861df5c0228812c612e9b1c200f3654b26e8bdfd36642b79c57_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-builder-rhel9@sha256:ec267e7bd945593d9bcd3be6201176e5b28376cdd5900d5da8c6f033b0420558_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9@sha256:97b8905f103277144991667b7953a08fd7a7b2edc448a3d5b5195f1af6802014_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9@sha256:d7fb722c1e4646d29ee32f5f9a74f7da3c87e07da52a7f28d58017931d375305_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9@sha256:e779c125e7fd9307e117fc7f4e4411f450871417f0447deb68c3821c26cae764_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9@sha256:e8113d25fd42fc3a31dc9bb120764c3b508995c23f73f7e99e0200ac411ad229_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator@sha256:2a24b3e44cd208c8176d4739cf3fc7a19e9fff3b531ab7718de6f5a99db4e4d1_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator@sha256:47fa330b3fe99501ba7d4b4bb5bc8b5ba0ea7880472070b27250b36fce3d035c_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator@sha256:71a06d4925ea829abc69b3ab518f08844faeaf524bad4c1e6fbc658b8227e0ab_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator@sha256:fa606a224ac6d3d5e17650a9b9a52e5cb76af57dc767adf79609e0ab95081304_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9@sha256:08cca1f9a75b0352f17d517f6b7bab53ccf7fba7ef1ff5cedf777c5b68dd15fa_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9@sha256:381cb54bf157086017cfea6db2a32895b6109640520b4f35f4791b2295c0db29_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9@sha256:8acf8e32e0dfca8b9a4cfcd765509424a8c1b884ad382a5f21d58e8c44e56cae_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9@sha256:b46b200558db6b92db270ee3749b8d14b778208ab9ab59e2b7c00dc018d2f3ce_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9@sha256:30745071ac71a3fdd97d062f180c8fd05d75d9955d4cfccbcf2aeec8deb7f084_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9@sha256:3ce796ad0c27b82cd6ba0cd946da69e2d62ad392f60dff571a6e826ab17dd8bc_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9@sha256:5c06c479d96b8340382301cb60505f05afcb064d3daf3951df9d8a108b1e4a97_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9@sha256:c0a8ca9591bb9385e2a8773aedbb40f84f4f4f229b0ec1b9bf16c4cedef2f6ad_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9@sha256:a48db0666b33ef1be5ab4ff02d7584c3fa1516c8a18f09295ae6a220d2e2ebf6_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9@sha256:b475aea1e95b14a065f76a83e5c8aa74f274955297762808f059ed857cd9cb92_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9@sha256:bf591d6bc29f3c394b29fd34b0a458cee5c3368130f1aa1e226e49fd112c44fc_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9@sha256:e7369d9a7242b115b78f7ff72c1a59912fb8304e93220a6faeaf44c25c6b5a71_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9-operator@sha256:2a12a79a557dd5e32b77eb977c3698ae2191f015121d38689369ae39f22a5f11_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • +89 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade Workaround: To mitigate this issue, users should avoid installing Python wheels from untrusted sources. It is strongly advised against using `pip install` with elevated privileges, such as `sudo`, when installing wheels. Additionally, administrators should inspect `entry_points.txt` within wheels for path separators or absolute paths before installation. Workaround: To mitigate this issue, users should avoid configuring `webpack-dev-server` with a broad proxy context (e.g., `/`) when WebSocket forwarding (`ws: true`) is enabled. Instead, define specific paths for the proxy context. Alternatively, disable WebSocket forwarding by omitting `ws: true` from the proxy entry if WebSocket functionality is not required for the proxy target. This configuration change may require restarting the `webpack-dev-server` instance to take effect. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Restrict network access to the EDA event stream endpoints at the firewall or load balancer level. Ensure that only trusted sources are permitted to reach the event stream ports. Additionally, monitor EDA event logs for any unexpected events originating from unverified sources. Workaround: Applications using AIOHTTP that are configured to load untrusted files via the `CookieJar.load()` function should implement input sanitization prior to loading. This prevents the injection of malicious code. Workaround: The risk can be mitigated by rejecting oversized serialized JWS inputs before they reach joserfc and enforcing strict request/body size limits at the application or reverse-proxy layer. Workaround: Do not load BDF font files from untrusted sources. Applications that only process standard image formats (PNG, JPEG, etc.) and do not use BdfFontFile or ImageFont.load() with BDF files are not affected. Workaround: Avoid processing untrusted GD 2.x image files with PIL.GdImageFile.open(). Use Image.open() instead, which includes decompression bomb protections for supported formats. If GdImageFile must be used, validate the image dimensions before calling load(). Restricting accepted image formats at the application boundary to only those explicitly needed can reduce exposure. Workaround: To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations. Workaround: When processing untrusted ASN.1 data with pyasn1, avoid calling prettyPrint(), str(), float(), int(), or performing comparisons or arithmetic on decoded Real (ASN.1 REAL type) objects. Instead, inspect the raw (mantissa, base, exponent) tuple directly. Where logging decoded ASN.1 structures is necessary, filter out or sanitize Real-typed values before conversion.

🔗 References (23)