DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Red Hat Ansible Automation Platform: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-10-21
Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um beliebigen Code mit Benutzer- oder Anwendungsrechten auszuführen, gültige kryptografische Token zu fälschen, die Authentifizierung zu umgehen, erweiterte Rechte zu erlangen, Denial-of-Service-Zustände auszulösen sowie Daten zu manipulieren oder offenzulegen.
01
beschreibt (24)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-92982US | high8.5 | — | ||
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) spec… | ||||
| CVE-2026-104851US | — | — | ||
fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates f… | ||||
| CVE-2026-103262US | high7.5 | — | ||
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a com… | ||||
| CVE-2026-102938US | — | — | ||
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format whil… | ||||
| CVE-2026-102937US | — | — | ||
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a… | ||||
| CVE-2026-102930US | —OT erhöht | — | ||
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, download_wheel() accepts pip and setuptools seed wheels fetched for periodic updates or th… | ||||
| CVE-2026-102925US | — | — | ||
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escap… | ||||
| CVE-2026-97689US | high7.5 | — | ||
urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the strea… | ||||
| CVE-2026-97687US | high8.1 | — | ||
urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode,… | ||||
| CVE-2026-102273US | — | — | ||
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level… | ||||
| CVE-2026-102272US | — | — | ||
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not… | ||||
| CVE-2026-102271US | — | — | ||
PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual ma… | ||||
| CVE-2026-102268US | — | — | ||
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM represen… | ||||
| CVE-2026-102267US | critical9.1OT erhöht | — | ||
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trus… | ||||
| CVE-2026-102266US | critical9.1 | — | ||
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key with… | ||||
| CVE-2026-90959US | high8.1 | — | ||
A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local fil… | ||||
| CVE-2026-94416US | medium6.8 | — | ||
An authorization bypass was found in the Ansible Automation Platform (AAP) gateway. The gateway API allows an authenticated administrator to create a new service key for the Contro… | ||||
| CVE-2026-63374US | — | — | ||
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validat… | ||||
| CVE-2026-90711US | — | — | ||
proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7,… | ||||
| CVE-2026-87776US | — | — | ||
compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib… | ||||
20 von 24 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory RHSA-2026:87004 vom 2026-10-21external
- Red Hat Security Advisory RHSA-2026:87124 vom 2026-10-21external
- Red Hat Security Advisory RHSA-2026:88198 vom 2026-10-22external
- Red Hat Security Advisory RHSA-2026:90440 vom 2026-10-26external
- openSUSE Security Update OPENSUSE-SU-2026:12119-1 vom 2026-10-24external
- SUSE Security Update SUSE-SU-2026:24377-1 vom 2026-10-27external
- WID-SEC-W-2026-4111 - CSAF Versionself
- WID-SEC-2026-4111 - Portal Versionself
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan