Ansible Core (Redhat) - vulnerabilities (CVEs)
15 CVEs, 1 in the last 30 days, 7 known versions, newest CVE from 2026-10-08. Vendor: Redhat.
CVEs of Ansible Core
- CVE-2026-89091 - CVSS 8.8 (high), 2026-10-08: A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using…
- CVE-2026-11332 - CVSS 7.8 (high), 2026-06-05: A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to…
- CVE-2026-34993 - CVSS 7.3 (high), 2026-06-02: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may…
- CVE-2026-39892 - CVSS 9.8 (critical), 2026-04-08: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous…
- CVE-2025-57847 - CVSS 6.4 (medium), 2026-04-08: A container privilege escalation flaw was found in certain Ansible Automation Platform images. This issue arises from the /etc/passwd file being created with…
- CVE-2026-27459 - CVSS 9.8 (critical), 2026-03-18: pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to…
- CVE-2026-32274 - CVSS 8.7 (high), 2026-03-12: Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is…
- CVE-2026-26007 - CVSS 8.2 (high), 2026-02-10: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or…
- CVE-2026-24049 - CVSS 7.1 (high), 2026-01-22: wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable…
- CVE-2025-56005 - CVSS 9.8 (critical), 2026-01-20: An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()`…
- CVE-2026-21441 - CVSS 8.9 (high), 2026-01-07: urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in…
- CVE-2025-69223 - CVSS 7.5 (high), 2026-01-05: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against…
- CVE-2024-11079 - CVSS 5.5 (medium), 2024-11-12: A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute…
- CVE-2024-9902 - CVSS 6.3 (medium), 2024-11-06: A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any…
- CVE-2024-8775 - CVSS 5.5 (medium), 2024-09-14: A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This…
