RHSA-2026:87120CriticalCVSS 9.1

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update

Published
October 21, 2026
Last Modified
October 30, 2026

🔗 CVE IDs covered (23)

CVE-2026-27459 →CVE-2026-39836 →CVE-2026-96760 →CVE-2026-102266 →CVE-2026-45820 →CVE-2026-93599 →CVE-2026-102267 →CVE-2026-102268 →CVE-2026-102271 →CVE-2026-102272 →CVE-2026-102930 →CVE-2026-104851 →CVE-2026-69243 →CVE-2026-92982 →CVE-2026-97687 →CVE-2026-97689 →CVE-2026-63374 →CVE-2026-90959 →CVE-2026-102273 →CVE-2026-102925 →CVE-2026-102937 →CVE-2026-102938 →CVE-2026-103262 →

📋 Description

CVE-2026-27459 — pyOpenSSL: DTLS cookie callback buffer overflow CVE-2026-39836 — net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows CVE-2026-45820 — fflate: fflate: Denial of Service via crafted ZIP archives CVE-2026-63374 — anyio: AnyIO: TLS certificate spoofing via improper internationalized domain name encoding CVE-2026-69243 — aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade CVE-2026-90959 — pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and Pulp Container registry signing key theft CVE-2026-92982 — ansible-operator-plugins: Ansible Operator Plugins: Arbitrary Code Execution via Jinja2 Template Injection CVE-2026-93599 — rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List CVE-2026-96760 — authlib: authlib: Signature verification bypass via deserialize_json CVE-2026-97687 — urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override CVE-2026-97689 — urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser CVE-2026-102266 — pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance CVE-2026-102267 — pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects CVE-2026-102268 — pyjwt: PyJWT: Authentication bypass via improper public key validation CVE-2026-102271 — pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets CVE-2026-102272 — pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling CVE-2026-102273 — pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets CVE-2026-102925 — virtualenv: virtualenv: Arbitrary code execution via crafted paths in activation scripts CVE-2026-102930 — virtualenv: virtualenv: Arbitrary code execution via unverified downloaded seed wheels CVE-2026-102937 — virtualenv: virtualenv: Arbitrary code execution via unescaped prompt in Windows activation script CVE-2026-102938 — virtualenv: virtualenv: Arbitrary code execution via configuration injection in prompt values CVE-2026-103262 — tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-104851 — fsspec: fsspec: arbitrary code execution via unrestricted template rendering in ReferenceFileSystem

🎯 Affected products119

  • Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:105ae98f9f09b478e0187f6a02e364e075b7b7389ec0f423f60929f0e1ebf6a8_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:5e4dc01e8eb5e8d728570f356489bf2f8639c103f5deb7a1679303b1fa5d297d_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:d8e326a9a6394fafc2e62da89271ff2229633e2868a87ea87414619018153f0e_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9@sha256:f81ff827a6eabf90fde67f47e873195f6498db9d0a7df905cfe3e3a1e3f0aec4_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-builder-rhel9@sha256:5824c570da3987a6ba20f8ea23ceab15943bb3e687a6e4d6861425b8b548b7c0_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-builder-rhel9@sha256:7928d753ac75d29afec75482b5401e880a9ce1a618177d7719034a26798801eb_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-builder-rhel9@sha256:acc90ea289558b40f36dc9710014c7b2dccb9bcb5966700b8bb38ef5bec3bd48_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-builder-rhel9@sha256:f13765b3ef9f9104dcbe6e7557cbd6124a006eeec4a7a39e13359e9beb7dad9d_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9@sha256:312d9f8ae54b00604128568bef9223c78948da193fa1acb7d1efb01add861f40_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9@sha256:a78104751caefc01d8382bd2aab43b261d5bc8034a4103bdebf97b629aed7813_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9@sha256:ee7fb1d6b0a65f6fc8cd9d6ff2cfe56551699bfcdaf0d6d81126edce554b2ef6_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9@sha256:fc6748cf1d0f80680acea5faf1eeca43a84d47f75e55e7c1e136e7f6ee968f9a_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator@sha256:3b0fe5a95e556a9e1763f67acf1b20288714207a0a60edcfc8682b77367b7f5c_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator@sha256:58d87508a7bab2b6c7a91d79fa464549f12409edeee645a98eab13bbd2568679_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator@sha256:82b4c520ed9483b57579beb670cd006bcb5bb29165543bc9c26229313fc27bd9_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator@sha256:d92b7a03057a856e2a4bb78ffc19d104e2bf2c1394f7d09a1ab4138edcc4e3ba_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9@sha256:1f01d546179c01c31457c89f4250ad0ffbf333b97eaa708cd034f14eadd2bd97_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9@sha256:aacdfd79cb7c54f419be116860d2a64225a079e70eacbda7a71614d593562e3d_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9@sha256:d13a47f318755cf79c520e427c81bd5876529becf9fc1112af0d5c1df0e86b9e_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/controller-rhel9@sha256:d67e90330123a555d8e9d0d954426a8c6ee45f2fb97221140764929777ad7a53_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9@sha256:3a385bf79b03a6e6c06a84e78be177d39b2ff35022ea11342c04e68b357f0949_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9@sha256:791989ea14eb0d4486abe3da74a75cff2fbfc9cf82eecb70b7fd8017fc36a86b_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9@sha256:b2ab2218294afdd9e0798da4ce37b8e51316c341543d55dacc594f1258748513_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9@sha256:b8d6c54b6e34cfc44e071c429a81921d9f770969296d16a83b71728fbabe84c2_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9@sha256:38bfb6110771353fd34278f9017e19161b7436291b68743f61486e9f6da21506_arm64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9@sha256:435488711b41da2a919e73032092a5ef64d82f0a53f24d8b1995735064fe95c2_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9@sha256:5290272ce9911aa1a4459023349ee21dee8aff42d2727654daaef00ff4f855dc_s390x as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9@sha256:92a7fde980b866b3f647c4bade0b26162fc89976cbbb97e2bcfd2957965c0435_ppc64le as a component of Red Hat Ansible Automation Platform 2.6
  • registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9-operator@sha256:0f96ce8c5c71487485d00c3beee124f783411e0053f411e7a29187e490dc2f37_amd64 as a component of Red Hat Ansible Automation Platform 2.6
  • +89 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade Workaround: To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: There is no available mitigation for this flaw other than updating the bundled fflate library to a fixed version (0.8.3 or later). Where the application controls the input, avoid passing untrusted ZIP archives to fflate's unzip()/unzipSync() APIs. Workaround: No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Workaround: To mitigate this vulnerability, configure the Ansible Operator watch to explicitly mark custom resource (CR) spec values as unsafe. This can be achieved by setting `markUnsafe: true` in the `watches.yaml` configuration for the affected operator. This action prevents Jinja2 template injection by ensuring CR spec fields are not evaluated as templates. A restart of the operator pod may be required for the changes to take effect. Workaround: Avoid creating, copying, or distributing virtual environments whose path contains characters such as ', `, $, ;, (, or ), and inspect the generated activation script before sourcing one that you did not create; these precautions prevent shell metacharacters embedded in a crafted path from being executed when an activation script is sourced. The upstream project has released a fixed version of virtualenv, so updating to a version that includes the fix (21.7.13 or later, or a product update containing it) also addresses the issue. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream project has fixed this issue in virtualenv 21.7.12, so upgrading to a version that includes this fix is recommended where available. As a precaution, avoid deriving virtualenv prompt values (the --prompt option, the VIRTUALENV_PROMPT environment variable, or the corresponding configuration setting) from untrusted input on Windows. Workaround: Strip line boundaries (such as newline, carriage return, and other Unicode line-separator characters) from any value before using it as --prompt or VIRTUALENV_PROMPT, and do not pass externally influenced data -- for example user-supplied strings or CI-derived values such as branch names -- as the virtualenv prompt. Ensure the VIRTUALENV_PROMPT environment variable and any configuration file that sets the prompt are sourced only from trusted input. The upstream project fixed this issue in virtualenv 21.7.11 by collapsing line boundaries when writing pyvenv.cfg, so updating to a version that contains this fix resolves the issue. For Red Hat products that bundle virtualenv, apply updates through the respective product channels. Workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.

🔗 References (27)