RHSA-2026:99006: Critical: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
Red Hat Ansible Automation Platform provides an enterprise framework forbuilding, deploying and managing IT automation at scale. IT Managers canprovide top-down guidelines on how automation is applied to individualteams, while automation developers retain the freedom to write tasks thatleverage existing knowledge without the overhead. Ansible AutomationPlatform makes it possible for users across an organization to share, vet,and manage automation content by means of a simple, powerful, and agentlesslanguage.Security Fix(es): automation-controller: GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec (CVE-2026-110858)For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVEpage(s) listed in the References section.For details about this release, refer to the release notes listed in theReferences section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/automation-controllerto a version that resolves this vulnerability.Fixed in 4.5.38-1.el9a - Upgrade
Upgrade
redhat/automation-controller-clito a version that resolves this vulnerability.Fixed in 4.5.38-1.el9a - Upgrade
Upgrade
redhat/automation-controller-serverto a version that resolves this vulnerability.Fixed in 4.5.38-1.el9a - Upgrade
Upgrade
redhat/automation-controller-uito a version that resolves this vulnerability.Fixed in 4.5.38-1.el9a - Upgrade
Upgrade
redhat/automation-controller-venv-towerto a version that resolves this vulnerability.Fixed in 4.5.38-1.el9a - Upgrade
Upgrade
redhat/automation-controllerto a version that resolves this vulnerability.Fixed in 4.5.38-1.el8a - Upgrade
Upgrade
redhat/automation-controller-clito a version that resolves this vulnerability.Fixed in 4.5.38-1.el8a - Upgrade
Upgrade
redhat/automation-controller-serverto a version that resolves this vulnerability.Fixed in 4.5.38-1.el8a - Upgrade
Upgrade
redhat/automation-controller-uito a version that resolves this vulnerability.Fixed in 4.5.38-1.el8a - Upgrade
Upgrade
redhat/automation-controller-venv-towerto a version that resolves this vulnerability.Fixed in 4.5.38-1.el8a - Upgrade
Upgrade
GitPythonto a version that resolves this vulnerability.Fixed in 3.2.0
Event History
Frequently Asked Questions
Which components are included in this update?
The update covers automation-controller, automation-controller-cli, automation-controller-server, automation-controller-ui, and automation-controller-venv-tower.
What vulnerability class is addressed?
The listed security fix addresses command injection in GitPython Remote.pull() refspec handling, affecting GitPython versions before 3.2.0.