WID-SEC-W-2026-2452
Vulnerability from csaf_certbund - Published: 2026-07-21 22:00 - Updated: 2026-08-02 22:00Summary
Red Hat Ansible Automation Platform (node-tar, linkify-it, protobufjs, brace-expansion, fast-uri, DOMPurify): Mehrere Schwachstellen
Severity
Hoch
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Red Hat Ansible Automation Platform ist eine End-to-End-Automatisierungsplattform für die Systemkonfiguration, die Softwarebereitstellung und die Orchestrierung erweiterter Workflows.
Angriff: Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, einen Denial-of-Service-Zustand auszulösen oder beliebigen Code auszuführen.
Betroffene Betriebssysteme: - Sonstiges
- UNIX
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Oracle Linux
Oracle
|
cpe:/o:oracle:linux:-
|
— | |
|
RESF Rocky Linux
RESF
|
cpe:/o:resf:rocky_linux:-
|
— | |
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Red Hat Ansible Automation Platform 2.2
Red Hat / Ansible Automation Platform
|
cpe:/a:redhat:ansible_automation_platform:2.2
|
2.2 |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Oracle Linux
Oracle
|
cpe:/o:oracle:linux:-
|
— | |
|
RESF Rocky Linux
RESF
|
cpe:/o:resf:rocky_linux:-
|
— | |
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Red Hat Ansible Automation Platform 2.2
Red Hat / Ansible Automation Platform
|
cpe:/a:redhat:ansible_automation_platform:2.2
|
2.2 |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Oracle Linux
Oracle
|
cpe:/o:oracle:linux:-
|
— | |
|
RESF Rocky Linux
RESF
|
cpe:/o:resf:rocky_linux:-
|
— | |
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Red Hat Ansible Automation Platform 2.2
Red Hat / Ansible Automation Platform
|
cpe:/a:redhat:ansible_automation_platform:2.2
|
2.2 |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Oracle Linux
Oracle
|
cpe:/o:oracle:linux:-
|
— | |
|
RESF Rocky Linux
RESF
|
cpe:/o:resf:rocky_linux:-
|
— | |
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Red Hat Ansible Automation Platform 2.2
Red Hat / Ansible Automation Platform
|
cpe:/a:redhat:ansible_automation_platform:2.2
|
2.2 |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Oracle Linux
Oracle
|
cpe:/o:oracle:linux:-
|
— | |
|
RESF Rocky Linux
RESF
|
cpe:/o:resf:rocky_linux:-
|
— | |
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Red Hat Ansible Automation Platform 2.2
Red Hat / Ansible Automation Platform
|
cpe:/a:redhat:ansible_automation_platform:2.2
|
2.2 |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Oracle Linux
Oracle
|
cpe:/o:oracle:linux:-
|
— | |
|
RESF Rocky Linux
RESF
|
cpe:/o:resf:rocky_linux:-
|
— | |
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Red Hat Ansible Automation Platform 2.2
Red Hat / Ansible Automation Platform
|
cpe:/a:redhat:ansible_automation_platform:2.2
|
2.2 |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Oracle Linux
Oracle
|
cpe:/o:oracle:linux:-
|
— | |
|
RESF Rocky Linux
RESF
|
cpe:/o:resf:rocky_linux:-
|
— | |
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Red Hat Ansible Automation Platform 2.2
Red Hat / Ansible Automation Platform
|
cpe:/a:redhat:ansible_automation_platform:2.2
|
2.2 |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Oracle Linux
Oracle
|
cpe:/o:oracle:linux:-
|
— | |
|
RESF Rocky Linux
RESF
|
cpe:/o:resf:rocky_linux:-
|
— | |
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Red Hat Ansible Automation Platform 2.2
Red Hat / Ansible Automation Platform
|
cpe:/a:redhat:ansible_automation_platform:2.2
|
2.2 |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Oracle Linux
Oracle
|
cpe:/o:oracle:linux:-
|
— | |
|
RESF Rocky Linux
RESF
|
cpe:/o:resf:rocky_linux:-
|
— | |
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Red Hat Ansible Automation Platform 2.2
Red Hat / Ansible Automation Platform
|
cpe:/a:redhat:ansible_automation_platform:2.2
|
2.2 |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Oracle Linux
Oracle
|
cpe:/o:oracle:linux:-
|
— | |
|
RESF Rocky Linux
RESF
|
cpe:/o:resf:rocky_linux:-
|
— | |
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Red Hat Ansible Automation Platform 2.2
Red Hat / Ansible Automation Platform
|
cpe:/a:redhat:ansible_automation_platform:2.2
|
2.2 |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Oracle Linux
Oracle
|
cpe:/o:oracle:linux:-
|
— | |
|
RESF Rocky Linux
RESF
|
cpe:/o:resf:rocky_linux:-
|
— | |
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
Red Hat Ansible Automation Platform 2.2
Red Hat / Ansible Automation Platform
|
cpe:/a:redhat:ansible_automation_platform:2.2
|
2.2 |
References
33 references
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Red Hat Ansible Automation Platform ist eine End-to-End-Automatisierungsplattform f\u00fcr die Systemkonfiguration, die Softwarebereitstellung und die Orchestrierung erweiterter Workflows.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuf\u00fchren, Daten zu manipulieren, einen Denial-of-Service-Zustand auszul\u00f6sen oder beliebigen Code auszuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Sonstiges\n- UNIX",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2026-2452 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2452.json"
},
{
"category": "self",
"summary": "WID-SEC-2026-2452 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2452"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:42815 vom 2026-07-21",
"url": "https://access.redhat.com/errata/RHSA-2026:42815"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:43625 vom 2026-07-22",
"url": "https://access.redhat.com/errata/RHSA-2026:43625"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:40765 vom 2026-07-22",
"url": "https://access.redhat.com/errata/RHSA-2026:40765"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:45360 vom 2026-07-24",
"url": "https://access.redhat.com/errata/RHSA-2026:45360"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:46539 vom 2026-07-27",
"url": "https://access.redhat.com/errata/RHSA-2026:46539"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:46623 vom 2026-07-27",
"url": "https://access.redhat.com/errata/RHSA-2026:46623"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:46558 vom 2026-07-27",
"url": "https://access.redhat.com/errata/RHSA-2026:46558"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:44268 vom 2026-07-28",
"url": "https://access.redhat.com/errata/RHSA-2026:44268"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:44239 vom 2026-07-28",
"url": "https://access.redhat.com/errata/RHSA-2026:44239"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:44264 vom 2026-07-28",
"url": "https://access.redhat.com/errata/RHSA-2026:44264"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:44237 vom 2026-07-28",
"url": "https://access.redhat.com/errata/RHSA-2026:44237"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:47059 vom 2026-07-29",
"url": "https://access.redhat.com/errata/RHSA-2026:47059"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:47060 vom 2026-07-28",
"url": "https://access.redhat.com/errata/RHSA-2026:47060"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:44267 vom 2026-07-28",
"url": "https://access.redhat.com/errata/RHSA-2026:44267"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:44263 vom 2026-07-28",
"url": "https://access.redhat.com/errata/RHSA-2026:44263"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:48151 vom 2026-07-29",
"url": "https://access.redhat.com/errata/RHSA-2026:48151"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:48126 vom 2026-07-29",
"url": "https://access.redhat.com/errata/RHSA-2026:48126"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:48033 vom 2026-07-29",
"url": "https://access.redhat.com/errata/RHSA-2026:48033"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:48032 vom 2026-07-29",
"url": "https://access.redhat.com/errata/RHSA-2026:48032"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:48124 vom 2026-07-29",
"url": "https://access.redhat.com/errata/RHSA-2026:48124"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:48034 vom 2026-07-29",
"url": "https://access.redhat.com/errata/RHSA-2026:48034"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:48891 vom 2026-07-31",
"url": "https://access.redhat.com/errata/RHSA-2026:48891"
},
{
"category": "external",
"summary": "Rocky Linux Security Advisory RLSA-2026:48032 vom 2026-07-30",
"url": "https://errata.build.resf.org/RLSA-2026:48032"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:48933 vom 2026-07-31",
"url": "https://access.redhat.com/errata/RHSA-2026:48933"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:48913 vom 2026-07-30",
"url": "https://access.redhat.com/errata/RHSA-2026:48913"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:48872 vom 2026-07-30",
"url": "https://access.redhat.com/errata/RHSA-2026:48872"
},
{
"category": "external",
"summary": "Rocky Linux Security Advisory RLSA-2026:48033 vom 2026-07-31",
"url": "https://errata.build.resf.org/RLSA-2026:48033"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2026-47058 vom 2026-08-01",
"url": "http://linux.oracle.com/errata/ELSA-2026-47058.html"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2026-47059 vom 2026-08-01",
"url": "https://linux.oracle.com/errata/ELSA-2026-47059.html"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2026-47057 vom 2026-08-01",
"url": "http://linux.oracle.com/errata/ELSA-2026-47057.html"
},
{
"category": "external",
"summary": "Rocky Linux Security Advisory RLSA-2026:48034 vom 2026-07-31",
"url": "https://errata.build.resf.org/RLSA-2026:48034"
}
],
"source_lang": "en-US",
"title": "Red Hat Ansible Automation Platform (node-tar, linkify-it, protobufjs, brace-expansion, fast-uri, DOMPurify): Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2026-08-02T22:00:00.000+00:00",
"generator": {
"date": "2026-08-03T07:18:31.491+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.6.0"
}
},
"id": "WID-SEC-W-2026-2452",
"initial_release_date": "2026-07-21T22:00:00.000+00:00",
"revision_history": [
{
"date": "2026-07-21T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2026-07-22T22:00:00.000+00:00",
"number": "2",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-07-26T22:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-07-27T22:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-07-28T22:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-07-29T22:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-07-30T22:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von Red Hat und Rocky Enterprise Software Foundation aufgenommen"
},
{
"date": "2026-08-02T22:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von Rocky Enterprise Software Foundation und Oracle Linux aufgenommen"
}
],
"status": "final",
"version": "8"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Oracle Linux",
"product": {
"name": "Oracle Linux",
"product_id": "T056236",
"product_identification_helper": {
"cpe": "cpe:/o:oracle:linux:-"
}
}
}
],
"category": "vendor",
"name": "Oracle"
},
{
"branches": [
{
"category": "product_name",
"name": "RESF Rocky Linux",
"product": {
"name": "RESF Rocky Linux",
"product_id": "T054581",
"product_identification_helper": {
"cpe": "cpe:/o:resf:rocky_linux:-"
}
}
}
],
"category": "vendor",
"name": "RESF"
},
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "2.2",
"product": {
"name": "Red Hat Ansible Automation Platform 2.2",
"product_id": "T057005",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ansible_automation_platform:2.2"
}
}
}
],
"category": "product_name",
"name": "Ansible Automation Platform"
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux",
"product": {
"name": "Red Hat Enterprise Linux",
"product_id": "67646",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:-"
}
}
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-59873",
"product_status": {
"known_affected": [
"T056236",
"T054581",
"67646",
"T057005"
]
},
"release_date": "2026-07-21T22:00:00.000+00:00",
"title": "CVE-2026-59873"
},
{
"cve": "CVE-2026-59874",
"product_status": {
"known_affected": [
"T056236",
"T054581",
"67646",
"T057005"
]
},
"release_date": "2026-07-21T22:00:00.000+00:00",
"title": "CVE-2026-59874"
},
{
"cve": "CVE-2026-48801",
"product_status": {
"known_affected": [
"T056236",
"T054581",
"67646",
"T057005"
]
},
"release_date": "2026-07-21T22:00:00.000+00:00",
"title": "CVE-2026-48801"
},
{
"cve": "CVE-2026-44289",
"product_status": {
"known_affected": [
"T056236",
"T054581",
"67646",
"T057005"
]
},
"release_date": "2026-07-21T22:00:00.000+00:00",
"title": "CVE-2026-44289"
},
{
"cve": "CVE-2026-44290",
"product_status": {
"known_affected": [
"T056236",
"T054581",
"67646",
"T057005"
]
},
"release_date": "2026-07-21T22:00:00.000+00:00",
"title": "CVE-2026-44290"
},
{
"cve": "CVE-2026-44291",
"product_status": {
"known_affected": [
"T056236",
"T054581",
"67646",
"T057005"
]
},
"release_date": "2026-07-21T22:00:00.000+00:00",
"title": "CVE-2026-44291"
},
{
"cve": "CVE-2026-44292",
"product_status": {
"known_affected": [
"T056236",
"T054581",
"67646",
"T057005"
]
},
"release_date": "2026-07-21T22:00:00.000+00:00",
"title": "CVE-2026-44292"
},
{
"cve": "CVE-2026-45740",
"product_status": {
"known_affected": [
"T056236",
"T054581",
"67646",
"T057005"
]
},
"release_date": "2026-07-21T22:00:00.000+00:00",
"title": "CVE-2026-45740"
},
{
"cve": "CVE-2026-13149",
"product_status": {
"known_affected": [
"T056236",
"T054581",
"67646",
"T057005"
]
},
"release_date": "2026-07-21T22:00:00.000+00:00",
"title": "CVE-2026-13149"
},
{
"cve": "CVE-2026-13676",
"product_status": {
"known_affected": [
"T056236",
"T054581",
"67646",
"T057005"
]
},
"release_date": "2026-07-21T22:00:00.000+00:00",
"title": "CVE-2026-13676"
},
{
"cve": "CVE-2026-49978",
"product_status": {
"known_affected": [
"T056236",
"T054581",
"67646",
"T057005"
]
},
"release_date": "2026-07-21T22:00:00.000+00:00",
"title": "CVE-2026-49978"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…