Product by Red Hat
Red Hat Ansible Automation Platform 2
28 known vulnerabilities in Red Hat Ansible Automation Platform 2 (Red Hat), 2 of them actively exploited (CISA KEV).
Key figures
28
Vulnerabilities
2
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2023-44487 | HTTP/2 Rapid Reset Attack Vulnerability In CISA KEValso in 158 other products | 7.5 | |
| Critical | CVE-2026-48710 | Kludex Starlette HTTP Request/Response Smuggling Vulnerability In CISA KEValso in 8 other products | 6.5 | |
| High | CVE-2021-20228 | Ansible: Exposure of Sensitive Information to an Unauthorized Actor | 7.5 | |
| High | CVE-2026-46625 | JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection | 7.5 | |
| High | CVE-2026-44495 | Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge | 7.0 | |
| High | CVE-2023-50782 | Python-cryptography: Observable Discrepancy | 7.5 | |
| High | CVE-2026-39979 | jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers | 6.5 | |
| Medium | CVE-2023-5115 | Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files | 6.3 | |
| Medium | CVE-2023-5189 | Hub: insecure galaxy-importer tarfile extraction | 6.3 | |
| High | CVE-2023-3971 | Controller: html injection in custom login info | 7.3 | |
| High | CVE-2021-3583 | Ansible: Improper Input Validation | 7.1 | |
| Medium | CVE-2022-2568 | Red Hat Ansible Automation Platform: Privilege Escalation | 6.5 | |
| High | CVE-2023-5764 | Ansible: template injection | 7.1 | |
| Medium | CVE-2023-4380 | Platform: token exposed at importing project | 6.3 | |
| Medium | CVE-2025-9908 | Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams | 6.7 | |
| Medium | CVE-2025-9909 | Aap-gateway: improper path validation in gateway allows credential exfiltration | 6.7 | |
| Medium | CVE-2025-9907 | Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda | 6.7 | |
| Medium | CVE-2025-57847 | Red Hat Ansible Automation Platform: Incorrect Default Permissions | 6.4 | |
| High | CVE-2021-4112 | Ansible-tower: Files or Directories Accessible to External Parties | 8.8 | |
| Medium | CVE-2024-10033 | Aap-gateway: xss on aap-gateway | 6.1 | |
| Medium | CVE-2022-1632 | Openshift: Improper Certificate Validation | 6.5 | |
| High | CVE-2023-4237 | Platform: ec2_key module prints out the private key directly to the standard output | 7.3 | |
| Medium | CVE-2022-3205 | Controller: cross site scripting in automation controller ui | 4.6 | |
| Medium | CVE-2024-0690 | Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration | 5.0 | |
| Medium | CVE-2022-3644 | Pulp Ansible: Plaintext Storage of a Password | 5.5 |