Red Hat Ansible Automation Platform 2/ansible-core

Red Hat · Package

4 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository URL (e.g. --upload-pack) -> RCECVE-2026-84503	Migration Toolkit for Applications 8/mta/mta-rhel9-operator Migration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-rhel9-operator	Red Hat	Medium	No fix reported	Not recorded
ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of CVE-2024-9902)CVE-2026-123037	Migration Toolkit for Applications 8/mta/mta-rhel9-operator Migration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-rhel9-operator	Red Hat	Medium	No fix reported	Not recorded
ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for CVE-2026-11332)CVE-2026-16493	Red Hat Ansible Automation Platform 2/ansible-core Red Hat Enterprise Linux 10/ansible-core	Red Hat	High	No fix reported	Not recorded
ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code executionCVE-2026-89091	Red Hat Advanced Cluster Management for Kubernetes 2/rhacm2/volsync-operator-bundle Red Hat Advanced Cluster Management for Kubernetes 2/rhacm2/volsync-rhel9	Red Hat	High	No fix reported	Not recorded