RHSA-2026:50850HighCVSS 10.0

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.1 security update

Published
August 5, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (25)

CVE-2026-47131 →CVE-2026-47141 →CVE-2026-47209 →CVE-2026-48801 →CVE-2026-59877 →CVE-2026-43998 →CVE-2026-43999 →CVE-2026-44002 →CVE-2026-44004 →CVE-2026-48068 →CVE-2026-44000 →CVE-2026-44001 →CVE-2026-44005 →CVE-2026-44007 →CVE-2026-44009 →CVE-2026-45411 →CVE-2026-47137 →CVE-2026-47140 →CVE-2026-9277 →CVE-2026-43997 →CVE-2026-44003 →CVE-2026-44006 →CVE-2026-47135 →CVE-2026-47139 →CVE-2026-44008 →

📋 Description

CVE-2026-9277 — shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators CVE-2026-43997 — vm2: vm2: Arbitrary code execution via sandbox escape CVE-2026-43998 — vm2: vm2: Remote code execution due to path restriction bypass via symlinks CVE-2026-43999 — vm2: vm2: Remote code execution via NodeVM builtin allowlist bypass CVE-2026-44000 — vm2: vm2: Sandbox escape allows direct interaction with host objects CVE-2026-44001 — vm2: vm2: Sandbox escape leads to Denial of Service CVE-2026-44002 — vm2: vm2: Information disclosure through unsanitized host paths CVE-2026-44003 — vm2: vm2: Sandbox escape due to code transformer optimization bypass CVE-2026-44004 — vm2: vm2: Denial of Service via host memory exhaustion CVE-2026-44005 — vm2: vm2: Sandbox Escape leading to Arbitrary Code Execution CVE-2026-44006 — vm2: vm2: Sandbox escape via arbitrary prototype access leading to arbitrary code execution CVE-2026-44007 — vm2: vm2: Arbitrary code execution via nested NodeVM bypass CVE-2026-44008 — vm2: vm2: Arbitrary code execution due to sandbox escape CVE-2026-44009 — vm2: vm2: Arbitrary Code Execution via Sandbox Escape CVE-2026-45411 — vm2: vm2: Arbitrary Code Execution due to sandbox escape vulnerability CVE-2026-47131 — vm2: vm2: Arbitrary code execution via sandbox escape vulnerability CVE-2026-47135 — vm2: vm2: Sandbox escape allows arbitrary code execution on the host system CVE-2026-47137 — vm2: vm2: Sandbox escape leading to arbitrary code execution via security bypass CVE-2026-47139 — vm2: vm2: Sandbox escape via internal HTTP built-ins leading to network restriction bypass CVE-2026-47140 — vm2: vm2: Arbitrary code execution due to incomplete sandbox restrictions CVE-2026-47141 — vm2: vm2: NodeVM observability builtins leak host process and HTTP request data CVE-2026-47209 — vm2: vm2: Integrity bypass via incorrect property assignment leading to potential arbitrary code execution CVE-2026-48068 — grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation CVE-2026-48801 — linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability CVE-2026-59877 — protobufjs: protobufjs: Denial of Service via crafted .proto schema

🎯 Affected products2

  • Red Hat Ansible Automation Platform 2.1
  • registry.redhat.io/ansible-automation-platform/automation-portal@sha256:a85a548cb563a32be76c6e7e015fd57d340e068e321bf34b060d9eb901c33c4d_amd64 as a component of Red Hat Ansible Automation Platform 2.1

✅ Remediation

For more about Ansible plugins for Red Hat Developer Hub, see References links Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Upgrade to @grpc/grpc-js 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4. There is no workaround for this vulnerability. Workaround: Applications that only encode or decode protobuf messages using trusted schemas are not directly affected. Until patched protobufjs packages (7.6.5 / 8.6.6) are available, do not parse .proto schema text from untrusted sources via parse, Root.load, or Root.loadSync. Where untrusted schema input cannot be avoided, isolate .proto parsing in a dedicated worker thread or subprocess and enforce an explicit timeout so a non-returning parse cannot block the main event loop. Optional process-manager controls (for example systemd restart-on-failure, or CPU/cgroup limits) may reduce host-level impact or aid recovery for supervised services, but they do not fix the parser bug and are not a substitute for input isolation or applying the update.

🔗 References (29)