Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
Related vulnerabilities
RHSA-2026:71113
Vulnerability from csaf_redhat - Published: 2026-09-23 21:13 - Updated: 2026-09-24 21:47A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The AWX_TASK_ENV setting accepts arbitrary environment variable keys with no restriction, and its values are applied directly to the running automation controller web and task processes rather than only to sandboxed execution environments. A user with the system administrator role can set variables such as REQUESTS_CA_BUNDLE, HTTPS_PROXY, SSLKEYLOGFILE, OPENSSL_CONF, or LD_PRELOAD that reconfigure the control-plane process TLS trust store, key-logging, OpenSSL engine, or dynamic linker. This enables silent interception of the outbound TLS the control plane uses to fetch external secret-store credentials and Red Hat subscription and Insights secrets, arbitrary file write of TLS session keys, and potential native code execution in the control-plane process, escalating an application administrator to compromise of the control plane and all tenant secrets.
RHSA-2026:71114
Vulnerability from csaf_redhat - Published: 2026-09-23 22:13 - Updated: 2026-09-24 21:47A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The AWX_TASK_ENV setting accepts arbitrary environment variable keys with no restriction, and its values are applied directly to the running automation controller web and task processes rather than only to sandboxed execution environments. A user with the system administrator role can set variables such as REQUESTS_CA_BUNDLE, HTTPS_PROXY, SSLKEYLOGFILE, OPENSSL_CONF, or LD_PRELOAD that reconfigure the control-plane process TLS trust store, key-logging, OpenSSL engine, or dynamic linker. This enables silent interception of the outbound TLS the control plane uses to fetch external secret-store credentials and Red Hat subscription and Insights secrets, arbitrary file write of TLS session keys, and potential native code execution in the control-plane process, escalating an application administrator to compromise of the control plane and all tenant secrets.
RHSA-2026:71179
Vulnerability from csaf_redhat - Published: 2026-09-23 22:20 - Updated: 2026-09-24 21:47A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The AWX_TASK_ENV setting accepts arbitrary environment variable keys with no restriction, and its values are applied directly to the running automation controller web and task processes rather than only to sandboxed execution environments. A user with the system administrator role can set variables such as REQUESTS_CA_BUNDLE, HTTPS_PROXY, SSLKEYLOGFILE, OPENSSL_CONF, or LD_PRELOAD that reconfigure the control-plane process TLS trust store, key-logging, OpenSSL engine, or dynamic linker. This enables silent interception of the outbound TLS the control plane uses to fetch external secret-store credentials and Red Hat subscription and Insights secrets, arbitrary file write of TLS session keys, and potential native code execution in the control-plane process, escalating an application administrator to compromise of the control plane and all tenant secrets.