RHSA-2026:6404HighCVSS 9.8

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update

Published
April 1, 2026
Last Modified
August 26, 2026

🔗 CVE IDs covered (11)

CVE-2026-30827 →CVE-2026-30922 →CVE-2025-69223 →CVE-2026-1615 →CVE-2026-25639 →CVE-2026-25990 →CVE-2025-69873 →CVE-2026-26007 →CVE-2026-28498 →CVE-2026-28802 →CVE-2026-29074 →

📋 Description

CVE-2025-69223 — aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb CVE-2025-69873 — ajv: ReDoS via $data reference CVE-2026-1615 — jsonpath: jsonpath: Arbitrary Code Execution via unsafe JSON Path expression evaluation CVE-2026-25639 — axios: Axios affected by Denial of Service via proto Key in mergeConfig CVE-2026-25990 — pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image CVE-2026-26007 — cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves CVE-2026-28498 — authlib: Authlib: Authentication bypass via forged OpenID Connect ID Tokens CVE-2026-28802 — authlib: Authlib: Signature verification bypass via malicious JWT allows unauthorized access CVE-2026-29074 — svgo: SVGO: Denial of Service via XML entity expansion CVE-2026-30827 — express-rate-limit: express-rate-limit: Denial of Service for IPv4 clients due to incorrect IPv6 subnet masking CVE-2026-30922 — pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

🎯 Affected products103

  • Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:224ab5167af0fc5fc9a2a8b7137029ba57121cb81ea22a419d0ec4c40e8d784b_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:7dfd054c74d7a378e3ca424d09d7c01953ce6a6d104de3e4eca3d362d13c8f33_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:d26bca87c2018b489472f1f1d4dbc23f5edb75584f59ebde540345df3f055b5a_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:e43db60ae78ea52aa60425b0bcd13d5660a72a3e888baa043125040df3b1e499_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-builder-rhel9@sha256:1fee430fbd0bd7fe7397e49f8397f76413c76b32773d1abffed1d9864c7d9de3_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-builder-rhel9@sha256:75de2b87ea13dca25bdba78cb2fd40ab151849934ac29ca1f3ff2ccc10e66e14_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-builder-rhel9@sha256:97bf81197a5bbfce3f58968f45ce2f12d3cb0ba934f09e14e35df1658ce87011_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-builder-rhel9@sha256:db8e631f92329e1da78b76a7d510e6dace445aecdcba5b7d65896c4dde5b6d96_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9@sha256:043c87b541b2325c404dfcb3a9dac7176e752ed0e5d86794a16173b6a6241847_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9@sha256:417b2cd5d8606cda83728e77b110f1cd8ef3aaeeca0e5cecce3059dba1ee0264_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9@sha256:8522589f076c035e66b5a9ed86d527a20addd215ce5ba7d995875b4e00a1bd15_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9@sha256:8f6d6144ac73ba9f0133ca1303405cb9f28309cea10213ad2a6745fe91221075_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator@sha256:040fdb42669fdffbf36816baa431fb75d622225ee3cf1e1125c9d3c9710276a5_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator@sha256:2e6151aad850692bc01a22f5c6c9bea03b7ffdaae81a19996ee5abbe4a6fe907_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator@sha256:51d11fcc48ae07e3e31ba3d15ca9f8302511f9db7c9a906cd1fc503da4e56851_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator@sha256:ee388c6cde6ddc916d0a727de14bf27aa2b4b276c10b252132ca3db00f4d5bc6_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9@sha256:1936dbed39475b5705a0c9d858475ac0ab9b691bb2b5cbbbe096764250bd1b5a_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9@sha256:3851cd311b32f446bdb7dbd4edc9b3a44b091aa47e3fd2aaa181adbee24d5c44_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9@sha256:5280259749ce19ade8a2c38d6c6df35e9b36885c78fa32fd21ac22ff9b6fae33_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9@sha256:a490261dea13fa75a1c4aa0a175da144c26a5dc727dc542609c25655adeb8819_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9@sha256:5b7d84bb78f87575c588bc0352de7ebe2ad76134612b7626eb3f2356987aa2cc_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9@sha256:78c68b90d3d4e96228da6795470f25c8dabe7281b4acd8f73f582ef6e27782df_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9@sha256:9e549ae5de2bfdde62a415e21472f2ce06bfc22be43f89b5ff3298e712d200fe_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9@sha256:c67254bbf63fe1220d58de04f36770afd4a6835a8903d03233310b13ed134a3b_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9@sha256:2c673483c46ff570b8295349c81cae38c26acc2482c13fc58b1871ccb2770166_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9@sha256:94097cac68936281f364fae0e90f42b19a7bc7d8a35c77dca2c339eaf2b87f20_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9@sha256:9de1fb1864a4cc20d35dd42b6c62d6e3d4438430ba944c35b9289eb429ac73c1_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9@sha256:fa5dd987c4032dd4749f81e265456b1abd3063c2b134434c32006d4a124a9dca_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9-operator@sha256:2ea73fdfacf7292d0e081eb3b57d2d723ca76c729b0f58f21df1da3206a14d93_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • +73 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, disable the $data feature if your application does not require it. If $data must be used, implement strict validation of the input fields that are referenced by the pattern keyword to ensure they contain only expected and safe characters. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Restrict network access to applications utilizing the express-rate-limit middleware to trusted clients or networks. Implementing firewall rules or network access controls can prevent untrusted actors from exploiting the shared rate-limit bucket vulnerability affecting IPv4-mapped IPv6 addresses on dual-stack servers.

🔗 References (15)