What’s Vulnerable › Products
Red Hat Ansible Automation Platform vulnerabilities
29 known vulnerabilities, 2 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.
Check whether your Red Hat Ansible Automation Platform version is affected
Exploited Red Hat Ansible Automation Platform vulnerabilities
- CVE-2026-48710 — Kludex Starlette HTTP Request/Response Smuggling Vulnerability
- CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability
Latest Red Hat Ansible Automation Platform vulnerabilities
- CVE-2026-44495 — Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge (CVSS 7.7)
- CVE-2026-46625 — JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection (CVSS 7.5)
- CVE-2026-48710 — Kludex Starlette HTTP Request/Response Smuggling Vulnerability (CVSS 6.5) — exploited
- CVE-2026-39979 — jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers (CVSS 6.5)
- CVE-2025-57847 — Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions (CVSS 6.4)
- CVE-2026-29063 — Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable (CVSS 9.8)
- CVE-2025-9909 — Aap-gateway: improper path validation in gateway allows credential exfiltration (CVSS 6.7)
- CVE-2025-9908 — Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams (CVSS 6.7)
- CVE-2025-9907 — Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda (CVSS 6.7)
- CVE-2025-53862 — Aap: aap-gateway: automation-hub: sensitive information disclosure (CVSS 3.5)
- CVE-2025-53861 — Aap: sensitive cookie(s) set without security flags (CVSS 3.1)
- CVE-2024-10033 — Aap-gateway: xss on aap-gateway (CVSS 6.1)
- CVE-2024-0690 — Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration (CVSS 5.5)
- CVE-2023-50782 — Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659 (CVSS 7.5)
- CVE-2023-5115 — Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files (CVSS 6.3)
- CVE-2023-5764 — Ansible: template injection (CVSS 7.8)
- CVE-2023-5189 — Hub: insecure galaxy-importer tarfile extraction (CVSS 6.5)
- CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability (CVSS 7.5) — exploited
- CVE-2023-4380 — Platform: token exposed at importing project (CVSS 6.3)
- CVE-2023-4237 — Platform: ec2_key module prints out the private key directly to the standard output (CVSS 7.8)
- CVE-2023-3971 — Controller: html injection in custom login info (CVSS 5.4)
- CVE-2022-3644 — (CVSS 5.5)
- CVE-2022-3205 — Controller: cross site scripting in automation controller ui (CVSS 6.1)
- CVE-2022-1632 — (CVSS 6.5)
- CVE-2021-4112 — (CVSS 8.8)