RHSA-2026:59137: Important: Red Hat Ansible Automation Platform 2.7 Product Security and Bug Fix Update

Q: Which components should be prioritized for this update?

Prioritize environments using automation-controller-cli because the advisory identifies a path traversal issue through the YAML !include directive. Also prioritize deployments containing Django or python3.12-django where GeoDjango spatial lookups are in use, as those components have a remote code execution issue.

Q: What attacker-controlled input is relevant to the path traversal issue?

The affected mechanism is the YAML !include directive in automation-controller-cli. The provided information does not specify the required access level or delivery path for a malicious YAML file.

Q: How can I determine whether my environment is in scope?

Check whether your deployment includes automation-controller-cli or the listed Red Hat Ansible development tools, and whether Django or python3.12-django is present. For the Django issue, specifically identify applications using GeoDjango spatial lookups.

Published Aug 24, 2026

Updated

Important: Red Hat Ansible Automation Platform 2.7 Product Security and Bug Fix Update

Other sources

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.Security Fix(es): automation-controller-cli: path traversal via YAML !include directive (CVE-2026-52902) python-django: Django: Remote code execution via GeoDjango spatial lookups (CVE-2026-15307) python3.12-django: Django: Remote code execution via GeoDjango spatial lookups (CVE-2026-15307) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.For details about this release, refer to the release notes listed in the References section.

— Red Hat

Affected Software

26 affected componentsFixes available

Red Hat Red Hat Ansible Developer

Red Hat Red Hat Ansible Inside

Red Hat Red Hat Ansible Automation Platform

redhat/ansible-creator<26.8.0-2.el10a

26.8.0-2.el10a

redhat/ansible-dev-environment<26.8.0-1.el10a

26.8.0-1.el10a

redhat/ansible-dev-tools<26.8.0-1.el10a

26.8.0-1.el10a

redhat/ansible-lint<26.8.0-1.el10a

26.8.0-1.el10a

redhat/ansible-navigator<26.8.0-2.el10a

26.8.0-2.el10a

redhat/automation-controller-cli<4.8.6-1.el10a

4.8.6-1.el10a

redhat/molecule<26.8.0-1.el10a

26.8.0-1.el10a

redhat/python-django<5.2.17-1.el10a

5.2.17-1.el10a

redhat/python-pytest-ansible<26.8.0-1.el10a

26.8.0-1.el10a

redhat/python-tox-ansible<26.8.0-1.el10a

26.8.0-1.el10a

redhat/python3-django<5.2.17-1.el10a

5.2.17-1.el10a

redhat/python3-pytest-ansible<26.8.0-1.el10a

26.8.0-1.el10a

redhat/python3-tox-ansible<26.8.0-1.el10a

26.8.0-1.el10a

redhat/ansible-creator<26.8.0-2.el9a

26.8.0-2.el9a

redhat/ansible-dev-environment<26.8.0-1.el9a

26.8.0-1.el9a

redhat/ansible-dev-tools<26.8.0-1.el9a

26.8.0-1.el9a

redhat/ansible-lint<26.8.0-1.el9a

26.8.0-1.el9a

redhat/ansible-navigator<26.8.0-2.el9a

26.8.0-2.el9a

redhat/automation-controller-cli<4.8.6-1.el9a

4.8.6-1.el9a

redhat/molecule<26.8.0-1.el9a

26.8.0-1.el9a

redhat/python3.12-django<5.2.17-1.el9a

5.2.17-1.el9a

redhat/python3.12-pytest-ansible<26.8.0-1.el9a

26.8.0-1.el9a

redhat/python3.12-tox-ansible<26.8.0-1.el9a

26.8.0-1.el9a

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/ansible-creator to a version that resolves this vulnerability.
Fixed in 26.8.0-2.el10a
Upgrade
Upgrade redhat/ansible-dev-environment to a version that resolves this vulnerability.
Fixed in 26.8.0-1.el10a
Upgrade
Upgrade redhat/ansible-dev-tools to a version that resolves this vulnerability.
Fixed in 26.8.0-1.el10a
Upgrade
Upgrade redhat/ansible-lint to a version that resolves this vulnerability.
Fixed in 26.8.0-1.el10a
Upgrade
Upgrade redhat/ansible-navigator to a version that resolves this vulnerability.
Fixed in 26.8.0-2.el10a
Upgrade
Upgrade redhat/automation-controller-cli to a version that resolves this vulnerability.
Fixed in 4.8.6-1.el10a
Upgrade
Upgrade redhat/molecule to a version that resolves this vulnerability.
Fixed in 26.8.0-1.el10a
Upgrade
Upgrade redhat/python-django to a version that resolves this vulnerability.
Fixed in 5.2.17-1.el10a
Upgrade
Upgrade redhat/python-pytest-ansible to a version that resolves this vulnerability.
Fixed in 26.8.0-1.el10a
Upgrade
Upgrade redhat/python-tox-ansible to a version that resolves this vulnerability.
Fixed in 26.8.0-1.el10a
Upgrade
Upgrade redhat/python3-django to a version that resolves this vulnerability.
Fixed in 5.2.17-1.el10a
Upgrade
Upgrade redhat/python3-pytest-ansible to a version that resolves this vulnerability.
Fixed in 26.8.0-1.el10a
Upgrade
Upgrade redhat/python3-tox-ansible to a version that resolves this vulnerability.
Fixed in 26.8.0-1.el10a
Upgrade
Upgrade redhat/ansible-creator to a version that resolves this vulnerability.
Fixed in 26.8.0-2.el9a
Upgrade
Upgrade redhat/ansible-dev-environment to a version that resolves this vulnerability.
Fixed in 26.8.0-1.el9a
Upgrade
Upgrade redhat/ansible-dev-tools to a version that resolves this vulnerability.
Fixed in 26.8.0-1.el9a
Upgrade
Upgrade redhat/ansible-lint to a version that resolves this vulnerability.
Fixed in 26.8.0-1.el9a
Upgrade
Upgrade redhat/ansible-navigator to a version that resolves this vulnerability.
Fixed in 26.8.0-2.el9a
Upgrade
Upgrade redhat/automation-controller-cli to a version that resolves this vulnerability.
Fixed in 4.8.6-1.el9a
Upgrade
Upgrade redhat/molecule to a version that resolves this vulnerability.
Fixed in 26.8.0-1.el9a
Upgrade
Upgrade redhat/python3.12-django to a version that resolves this vulnerability.
Fixed in 5.2.17-1.el9a
Upgrade
Upgrade redhat/python3.12-pytest-ansible to a version that resolves this vulnerability.
Fixed in 26.8.0-1.el9a
Upgrade
Upgrade redhat/python3.12-tox-ansible to a version that resolves this vulnerability.
Fixed in 26.8.0-1.el9a
Upgrade
Upgrade automation-controller-cli to a version that resolves this vulnerability.
Patch CVE-2026-52902
Upgrade
Upgrade python-django to a version that resolves this vulnerability.
Patch CVE-2026-15307
Upgrade
Upgrade python3.12-django to a version that resolves this vulnerability.
Patch CVE-2026-15307

Event History

Aug 24, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Advisory Published

via Red Hat·04:19 PM

Data Sourced

via Red Hat·04:19 PM

Severity

Frequently Asked Questions

Which components should be prioritized for this update?

Prioritize environments using automation-controller-cli because the advisory identifies a path traversal issue through the YAML !include directive. Also prioritize deployments containing Django or python3.12-django where GeoDjango spatial lookups are in use, as those components have a remote code execution issue.

What attacker-controlled input is relevant to the path traversal issue?

The affected mechanism is the YAML !include directive in automation-controller-cli. The provided information does not specify the required access level or delivery path for a malicious YAML file.

How can I determine whether my environment is in scope?

Check whether your deployment includes automation-controller-cli or the listed Red Hat Ansible development tools, and whether Django or python3.12-django is present. For the Django issue, specifically identify applications using GeoDjango spatial lookups.

RHSA-2026:59137: Important: Red Hat Ansible Automation Platform 2.7 Product Security and Bug Fix Update

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which components should be prioritized for this update?

What attacker-controlled input is relevant to the path traversal issue?

How can I determine whether my environment is in scope?

Company

Resources

Contact

Frequently Asked Questions

Which components should be prioritized for this update?

What attacker-controlled input is relevant to the path traversal issue?

How can I determine whether my environment is in scope?