RHSA-2026:87004HighCVSS 8.1

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Published
October 21, 2026
Last Modified
October 24, 2026

🔗 CVE IDs covered (10)

CVE-2026-45820 →CVE-2026-90711 →CVE-2026-102267 →CVE-2026-102271 →CVE-2026-102272 →CVE-2026-102273 →CVE-2026-87776 →CVE-2026-90959 →CVE-2026-94416 →CVE-2026-102266 →

📋 Description

CVE-2026-45820 — fflate: fflate: Denial of Service via crafted ZIP archives CVE-2026-87776 — compression: compression: Denial of Service via memory leak on premature response close CVE-2026-90711 — proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet CVE-2026-90959 — pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and Pulp Container registry signing key theft CVE-2026-94416 — aap-gateway: aap-gateway: authorization bypass via workload identity token forgery CVE-2026-102266 — pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance CVE-2026-102267 — pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects CVE-2026-102271 — pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets CVE-2026-102272 — pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling CVE-2026-102273 — pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets

🎯 Affected products161

  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • aap-metrics-utility-0:2.6.20261019-1.el9ap.aarch64 as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • aap-metrics-utility-0:2.6.20261019-1.el9ap.ppc64le as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • aap-metrics-utility-0:2.6.20261019-1.el9ap.s390x as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • aap-metrics-utility-0:2.6.20261019-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • aap-metrics-utility-0:2.6.20261019-1.el9ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • ansible-automation-platform-installer-0:2.6-9.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • ansible-automation-platform-installer-0:2.6-9.el9ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • ansible-creator-0:26.10.0-1.el10ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • ansible-creator-0:26.10.0-1.el10ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • ansible-creator-0:26.10.0-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • ansible-creator-0:26.10.0-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • ansible-dev-environment-0:26.10.0-1.el10ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • ansible-dev-environment-0:26.10.0-1.el10ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • ansible-dev-environment-0:26.10.0-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • ansible-dev-environment-0:26.10.0-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • ansible-dev-tools+server-0:26.10.0-1.el10ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • ansible-dev-tools+server-0:26.10.0-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • ansible-dev-tools-0:26.10.0-1.el10ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • ansible-dev-tools-0:26.10.0-1.el10ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • ansible-dev-tools-0:26.10.0-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • ansible-dev-tools-0:26.10.0-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • ansible-lint-0:26.10.1-1.el10ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • ansible-lint-0:26.10.1-1.el10ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • ansible-lint-0:26.10.1-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • ansible-lint-0:26.10.1-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • ansible-navigator-0:26.10.0-1.el10ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • ansible-navigator-0:26.10.0-1.el10ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • ansible-navigator-0:26.10.0-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • +131 more not shown

✅ Remediation

For details on how to apply this update, refer to Ansible Automation Platform documentation. Workaround: There is no available mitigation for this flaw other than updating the bundled fflate library to a fixed version (0.8.3 or later). Where the application controls the input, avoid passing untrusted ZIP archives to fflate's unzip()/unzipSync() APIs. Workaround: Update the compression middleware to version 1.8.2 or later. No supported workaround is currently available if the affected version cannot be updated. Workaround: To mitigate this flaw through configuration: 1. Configure trusted proxy definitions using standard IPv4 notation (such as `10.0.0.0/8`) rather than IPv4-mapped IPv6 notation. 2. If IPv4-mapped IPv6 notation is required, set the subnet prefix length to at least 97 to cover the mapped boundary (for example, specify `::ffff:10.0.0.0/104` instead of `::ffff:10.0.0.0/8`). 3. Alternatively, sanitize or strip incoming `X-Forwarded-For` headers at edge load balancers or boundary reverse proxies before passing traffic to backend applications. Warning: Modifying application configuration files requires restarting the Node.js application service, which will temporarily interrupt service availability and active connections. Workaround: No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Workaround: Audit and revoke any Controller service keys that were not provisioned by the installer; this is the most important immediate action and applies to environments upgraded from 2.5/2.6 as well. Where the integration is not required, set FEATURE_OIDC_WORKLOAD_IDENTITY_ENABLED=false to disable the workload-identity endpoint. Rotate any downstream credentials (e.g. in HashiCorp Vault) that could have been retrieved via a forged workload identity. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (15)