RHSA-2026:87124CriticalCVSS 9.1

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Container Release Update

Published
October 21, 2026
Last Modified
October 30, 2026

🔗 CVE IDs covered (21)

CVE-2026-63374 →CVE-2026-102266 →CVE-2026-102271 →CVE-2026-102925 →CVE-2026-102937 →CVE-2026-102938 →CVE-2026-104851 →CVE-2026-27459 →CVE-2026-87817 →CVE-2026-97687 →CVE-2026-102267 →CVE-2026-102273 →CVE-2026-11332 →CVE-2026-90959 →CVE-2026-92982 →CVE-2026-102268 →CVE-2026-102930 →CVE-2026-103262 →CVE-2026-94416 →CVE-2026-97689 →CVE-2026-102272 →

📋 Description

CVE-2026-11332 — ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution CVE-2026-27459 — pyOpenSSL: DTLS cookie callback buffer overflow CVE-2026-63374 — anyio: AnyIO: TLS certificate spoofing via improper internationalized domain name encoding CVE-2026-87817 — GitPython: GitPython: Remote Code Execution via Git directory impersonation CVE-2026-90959 — pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and Pulp Container registry signing key theft CVE-2026-92982 — ansible-operator-plugins: Ansible Operator Plugins: Arbitrary Code Execution via Jinja2 Template Injection CVE-2026-94416 — aap-gateway: aap-gateway: authorization bypass via workload identity token forgery CVE-2026-97687 — urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override CVE-2026-97689 — urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser CVE-2026-102266 — pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance CVE-2026-102267 — pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects CVE-2026-102268 — pyjwt: PyJWT: Authentication bypass via improper public key validation CVE-2026-102271 — pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets CVE-2026-102272 — pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling CVE-2026-102273 — pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets CVE-2026-102925 — virtualenv: virtualenv: Arbitrary code execution via crafted paths in activation scripts CVE-2026-102930 — virtualenv: virtualenv: Arbitrary code execution via unverified downloaded seed wheels CVE-2026-102937 — virtualenv: virtualenv: Arbitrary code execution via unescaped prompt in Windows activation script CVE-2026-102938 — virtualenv: virtualenv: Arbitrary code execution via configuration injection in prompt values CVE-2026-103262 — tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-104851 — fsspec: fsspec: arbitrary code execution via unrestricted template rendering in ReferenceFileSystem

🎯 Affected products65

  • Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/aap-must-gather-rhel9@sha256:4fcf31d56a3e3b01c183e328ebc5fe76edcd68f84b4369dfc66b0c0b5c02f0ab_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/aap-must-gather-rhel9@sha256:ad3574ed81cb43c0864ac4e83447f80a637b73947752dd1d2b9e98bd2a5dc12f_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ansible-builder-rhel9@sha256:d01360ac95eb326377b500a73389a9dfaf1342441624468392de98aa33b6da60_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ansible-builder-rhel9@sha256:ed25425228b9cd763627904f1573b69330aca1b9e9d0cf5ff1b875a4172fef98_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ansible-dev-tools-rhel9@sha256:02bae04608e97c794a5ef8cd9f576a5cd17aac7cf5afac5a47b58d9eaf8861a5_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ansible-dev-tools-rhel9@sha256:9048204760b610382c7a9bc1749b244a88b3f9271ec6934acbe9796a6f747720_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ansible-devspaces-rhel9@sha256:0b7affecdc089eff56eed01a606501001b975d6cde30230934139b260f0e64e8_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ansible-devspaces-rhel9@sha256:affa5f76c69a86bcd13ba936069b520003c89b10a0fc91680f21f474db843a77_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/controller-rhel9-operator@sha256:43566834c8e89998c738dea217fad8a02986c9d539ece94225a2f69bb0c94ba9_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/controller-rhel9-operator@sha256:80d462cd8dd841abe32a12fa6ee56d66c18fd089eec7cf7f24e166452dcac19b_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/controller-rhel9@sha256:5c6a59a98ce88b77fe54f0a2b3ac4b8ee8642fe8246c4d134f50a32dcf09516a_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/controller-rhel9@sha256:d78c793278ce1c40cca381f65e0d4c72aa167f61555180f2f4f283db6014c465_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9@sha256:3fc08cac1d10813f10a1a5e9b27012c63b5e447ef9863fb4b2680c863154c835_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9@sha256:c808eb39ea3fc92c3e1524e2345378ca4e5cf26044e8f6ba21f059315fbe4a83_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/de-supported-rhel9@sha256:39b7dfecdb30de5953deace7c064ac83037e73663c41fb904a409a79b4a580a8_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/de-supported-rhel9@sha256:412d9a18046bb65f71071d4624f41332425fb716b2e9049b02d599f4a1ce53f3_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9-operator@sha256:551a6f4fb54b5202daf737e6d8b3eb96bcffd9fd1fb5dd5b967bf88ddb122c2a_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9-operator@sha256:68171e97cffef583e3c6179a6f071c7e306757d3ad5b17e7f9ba6663687b0a36_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9@sha256:7d14e4a2527dc77b8052a0f736cef02ff2eca403608aba015239b7488cc402e7_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9@sha256:e40310bfa9bb7d1e597bafd12133b77efc24f14e68f93dfcf3baaa69f60edcbb_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/eda-controller-ui-rhel9@sha256:1ef6a84e65baadee002aa2cf315e28302486ddfa55f61d830e5b5adf6bd195ea_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/eda-controller-ui-rhel9@sha256:873f095b34c5b98fc8d1de3acc658cc409b5a9df1adea258e6523f12b20f447a_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ee-control-plane-rhel9@sha256:1b7455fccd042d8884851b7f43bf27c54e9e8190194e18ddb88633370a89965c_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ee-control-plane-rhel9@sha256:20aa33164c9f389ffc066053c100385dc9fc66871863b69291d37f2754f2062f_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9@sha256:6233050175e614e28a197a28bbecd2f8de21e606cc9ff18090489a03bec16bd7_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9@sha256:a83211219db554d9eceab1628c76177fee23278ec7434bcd226a0eab6c1278ca_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9@sha256:ea5407719109c8b265b2e542153671bc01094b48249c83c9d97fbca0943e7735_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9@sha256:fb92b57dcf6b615d5570e0844d369436af4bfe52f59432661977112db6b6b430_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ee-supported-rhel9@sha256:acc8a87d096044b9e6ac3f998135eac1a6a25eabae4ed39dd315e4d085cd5d76_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • +35 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.7#Upgrade Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes. Workaround: No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Workaround: To mitigate this vulnerability, configure the Ansible Operator watch to explicitly mark custom resource (CR) spec values as unsafe. This can be achieved by setting `markUnsafe: true` in the `watches.yaml` configuration for the affected operator. This action prevents Jinja2 template injection by ensuring CR spec fields are not evaluated as templates. A restart of the operator pod may be required for the changes to take effect. Workaround: Audit and revoke any Controller service keys that were not provisioned by the installer; this is the most important immediate action and applies to environments upgraded from 2.5/2.6 as well. Where the integration is not required, set FEATURE_OIDC_WORKLOAD_IDENTITY_ENABLED=false to disable the workload-identity endpoint. Rotate any downstream credentials (e.g. in HashiCorp Vault) that could have been retrieved via a forged workload identity. Workaround: Avoid creating, copying, or distributing virtual environments whose path contains characters such as ', `, $, ;, (, or ), and inspect the generated activation script before sourcing one that you did not create; these precautions prevent shell metacharacters embedded in a crafted path from being executed when an activation script is sourced. The upstream project has released a fixed version of virtualenv, so updating to a version that includes the fix (21.7.13 or later, or a product update containing it) also addresses the issue. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream project has fixed this issue in virtualenv 21.7.12, so upgrading to a version that includes this fix is recommended where available. As a precaution, avoid deriving virtualenv prompt values (the --prompt option, the VIRTUALENV_PROMPT environment variable, or the corresponding configuration setting) from untrusted input on Windows. Workaround: Strip line boundaries (such as newline, carriage return, and other Unicode line-separator characters) from any value before using it as --prompt or VIRTUALENV_PROMPT, and do not pass externally influenced data -- for example user-supplied strings or CI-derived values such as branch names -- as the virtualenv prompt. Ensure the VIRTUALENV_PROMPT environment variable and any configuration file that sets the prompt are sourced only from trusted input. The upstream project fixed this issue in virtualenv 21.7.11 by collapsing line boundaries when writing pyvenv.cfg, so updating to a version that contains this fix resolves the issue. For Red Hat products that bundle virtualenv, apply updates through the respective product channels. Workaround: Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content. 1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies. 2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers. 3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests. Caveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.

🔗 References (25)