live wire
▸AI · Red Hat documents usage-based admission fair sharing for Kueue 1.4 on OpenShiftRed Hat Developer▸AI: Red Hat maps governed firewall changes from ServiceNow through Ansible and two human approval gatesRed Hat Developer▸CLUSTER MGMT · ACM 2.17 makes Submariner 0.24 GA with Important-rated fixesRed Hat Errata▸PLATFORM · Red Hat makes on-premises Lightspeed recommendations GA for Satellite 6.18Red Hat Errata▸SECURITY · Red Hat Hardened Images updates Tomcat 10 for nine authentication, access-control and DoS flawsRed Hat Errata▸AI · Open Data Hub 3.6.0 EA1 bundles Trainer, MLflow and llm-d componentsOpen Data Hub▸AI · Speculators 0.6.0 adds P-EAGLE parallel drafting for vLLM speculative decodingRed Hat Developer▸SECURITY · OpenShift 4.17.57 fixes seven Go and TLS CVEs in an Important-rated updateRed Hat Errata▸AI · Red Hat benchmarks local LLM guardrails with EvalHub, exposing regex accuracy and latency trade-offsRed Hat Developer▸AI · Red Hat maps silent tool-call failures across agentic pipelinesRed Hat▸API · Kuadrant 1.5.3 adds GRPCRoute policies and developer-portal API-key workflowsKuadrant▸AI · (Aug 25) IBM releases Apache-2.0 Granite 4.2 reasoning models in 3B, 8B and 30B sizesIBM Research▸JAVA · Red Hat build of Quarkus 3.33.3.SP1 fixes 13 CVEs in an Important-rated updateRed Hat errata▸AI · vLLM moves Kimi K2 RL weight sync across 384 H100s in 7.53 seconds (Aug 22)vLLM▸AI · Red Hat documents usage-based admission fair sharing for Kueue 1.4 on OpenShiftRed Hat Developer▸AI: Red Hat maps governed firewall changes from ServiceNow through Ansible and two human approval gatesRed Hat Developer▸CLUSTER MGMT · ACM 2.17 makes Submariner 0.24 GA with Important-rated fixesRed Hat Errata▸PLATFORM · Red Hat makes on-premises Lightspeed recommendations GA for Satellite 6.18Red Hat Errata▸SECURITY · Red Hat Hardened Images updates Tomcat 10 for nine authentication, access-control and DoS flawsRed Hat Errata▸AI · Open Data Hub 3.6.0 EA1 bundles Trainer, MLflow and llm-d componentsOpen Data Hub▸AI · Speculators 0.6.0 adds P-EAGLE parallel drafting for vLLM speculative decodingRed Hat Developer▸SECURITY · OpenShift 4.17.57 fixes seven Go and TLS CVEs in an Important-rated updateRed Hat Errata▸AI · Red Hat benchmarks local LLM guardrails with EvalHub, exposing regex accuracy and latency trade-offsRed Hat Developer▸AI · Red Hat maps silent tool-call failures across agentic pipelinesRed Hat▸API · Kuadrant 1.5.3 adds GRPCRoute policies and developer-portal API-key workflowsKuadrant▸AI · (Aug 25) IBM releases Apache-2.0 Granite 4.2 reasoning models in 3B, 8B and 30B sizesIBM Research▸JAVA · Red Hat build of Quarkus 3.33.3.SP1 fixes 13 CVEs in an Important-rated updateRed Hat errata▸AI · vLLM moves Kimi K2 RL weight sync across 384 H100s in 7.53 seconds (Aug 22)vLLM
upstreambeat.ai
releasePLATFORM

Ansible Automation Platform patch closes controller credential-leak paths and adds MCP discovery

The August 24 update spans controller, gateway, Lightspeed and execution-environment images, while a new endpoint lets MCP clients discover tools progressively.

Before-and-after view of AAP patch closing leaks and adding MCP discovery.
AI-generated illustration
By The News Desk· Aug 28, 2026

Red Hat’s August 24 patch for Ansible Automation Platform 2.7 is broader than its build number suggests. Release 2.7.20260824, also identified as 2.7-6, combines 25 security updates, 16 performance and operational enhancements, and 31 bug fixes across 21 components.

The immediate operator task is to treat this as a platform-wide update rather than a controller-only patch. The release moves automation controller to 4.8.6, automation hub to 4.12.5, Event-Driven Ansible to 1.3.8 and Receptor to 1.6.7, alongside new containerized-installer and Operator builds.

Which fixes need attention first

The highest-priority exposure depends on which AAP services are enabled and reachable. The controller fixes include an SSRF path in webhook status callbacks that could leak a Git personal access token, another SSRF and credential-leak issue in notification backends, path-traversal writes during project-archive extraction, arbitrary code execution through injected Git configuration, and YAML !include path traversal.

Lightspeed’s image receives fixes for a GeoDjango remote-code-execution flaw, HTTP request smuggling, denial-of-service issues and a DTLS buffer overflow. Gateway, Event-Driven Ansible and the supported and minimal execution-environment images also carry dependency fixes. Operators using those images should update the corresponding deployed component or execution environment, not assume that upgrading only the controller covers the listed vulnerabilities.

Red Hat’s patch page does not provide an environment-specific exploitability matrix. A practical triage order is therefore to inventory the affected services and images, prioritize internet- or tenant-facing controller integrations, rotate credentials if there is evidence that affected webhook or notification paths were abused, and then validate the upgraded component versions against the release table.

What MCP discovery changes

The same patch adds /mcp/discover to the Ansible Automation Platform MCP server. Red Hat describes it as progressive tool discovery intended to reduce token consumption: an MCP client can discover relevant tools without loading the server’s entire tool catalog into its working context.

A new content_discovery toolset also groups Galaxy content tools with Automation Intelligent Assistant search. For teams integrating automation controller with agents, that changes the integration shape from a large static tool declaration toward capability discovery at runtime. It should make narrower prompts and selective tool exposure easier, although access controls still need to be enforced by the platform rather than delegated to the model.

The update also adds health probes for the chatbot and MCP sidecars and fixes a day-two containerized-installer error when enabling MCP tools. Those details matter for existing deployments: the new discovery endpoint is accompanied by lifecycle fixes needed to keep the MCP service observable and enable it after installation.

Operational improvements beyond security

Large installations get several controller database fixes. Red Hat reports changes to RBAC query planning, activity-stream counts, abandoned PostgreSQL queries and unified-job-list endpoints that had become up to ten times slower per database call. The release also provides a repeatable, non-blocking awx-manage create_host_summary_index command for improving host-list performance.

That mix makes 2.7.20260824 both a security update and an operational one. The upgrade decision should account for every deployed AAP component, while MCP consumers should test discovery and content search separately from existing statically configured tools.

sources

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk