Search

Find a vulnerability

Search criteria Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    RHSA-2026:71114

    Vulnerability from csaf_redhat - Published: 2026-09-23 22:13 - Updated: 2026-09-24 12:24
    Summary
    Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    Severity
    Critical
    Scope
    56 vulnerabilities in this advisory, including CVE-2026-84678.
    CVE-2026-84678

    A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The GALAXY_TASK_ENV setting, whose values are added to the environment of the ansible-galaxy commands run during project updates, is not validated to exclude dynamic-linker and interpreter environment variables such as LD_PRELOAD and PYTHONPATH, unlike the sibling AWX_TASK_ENV setting. A user with the system administrator role can set these variables to point at a file placed inside a project checkout on the shared projects volume, causing arbitrary native or Python code to execute inside the project synchronization execution environment on the control plane. This yields read and write access to every organization's project content and to injected Galaxy server tokens, resulting in a cross-tenant compromise of the automation content supply chain.

    Fixed: 8 products Known not affected: 130 products
    https://access.redhat.com/errata/RHSA-2026:71114
    Open the full advisory

    RHSA-2026:71177

    Vulnerability from csaf_redhat - Published: 2026-09-23 22:11 - Updated: 2026-09-24 12:24
    Summary
    Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Container Release Update
    Severity
    Critical
    Scope
    61 vulnerabilities in this advisory, including CVE-2026-84678.
    CVE-2026-84678

    A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The GALAXY_TASK_ENV setting, whose values are added to the environment of the ansible-galaxy commands run during project updates, is not validated to exclude dynamic-linker and interpreter environment variables such as LD_PRELOAD and PYTHONPATH, unlike the sibling AWX_TASK_ENV setting. A user with the system administrator role can set these variables to point at a file placed inside a project checkout on the shared projects volume, causing arbitrary native or Python code to execute inside the project synchronization execution environment on the control plane. This yields read and write access to every organization's project content and to injected Galaxy server tokens, resulting in a cross-tenant compromise of the automation content supply chain.

    Fixed: 2 products Known not affected: 60 products
    https://access.redhat.com/errata/RHSA-2026:71177
    Open the full advisory