live wire
▸AI · Red Hat documents usage-based admission fair sharing for Kueue 1.4 on OpenShiftRed Hat Developer▸AI: Red Hat maps governed firewall changes from ServiceNow through Ansible and two human approval gatesRed Hat Developer▸CLUSTER MGMT · ACM 2.17 makes Submariner 0.24 GA with Important-rated fixesRed Hat Errata▸PLATFORM · Red Hat makes on-premises Lightspeed recommendations GA for Satellite 6.18Red Hat Errata▸SECURITY · Red Hat Hardened Images updates Tomcat 10 for nine authentication, access-control and DoS flawsRed Hat Errata▸AI · Open Data Hub 3.6.0 EA1 bundles Trainer, MLflow and llm-d componentsOpen Data Hub▸AI · Speculators 0.6.0 adds P-EAGLE parallel drafting for vLLM speculative decodingRed Hat Developer▸SECURITY · OpenShift 4.17.57 fixes seven Go and TLS CVEs in an Important-rated updateRed Hat Errata▸AI · Red Hat benchmarks local LLM guardrails with EvalHub, exposing regex accuracy and latency trade-offsRed Hat Developer▸AI · Red Hat maps silent tool-call failures across agentic pipelinesRed Hat▸API · Kuadrant 1.5.3 adds GRPCRoute policies and developer-portal API-key workflowsKuadrant▸AI · (Aug 25) IBM releases Apache-2.0 Granite 4.2 reasoning models in 3B, 8B and 30B sizesIBM Research▸JAVA · Red Hat build of Quarkus 3.33.3.SP1 fixes 13 CVEs in an Important-rated updateRed Hat errata▸AI · vLLM moves Kimi K2 RL weight sync across 384 H100s in 7.53 seconds (Aug 22)vLLM▸AI · Red Hat documents usage-based admission fair sharing for Kueue 1.4 on OpenShiftRed Hat Developer▸AI: Red Hat maps governed firewall changes from ServiceNow through Ansible and two human approval gatesRed Hat Developer▸CLUSTER MGMT · ACM 2.17 makes Submariner 0.24 GA with Important-rated fixesRed Hat Errata▸PLATFORM · Red Hat makes on-premises Lightspeed recommendations GA for Satellite 6.18Red Hat Errata▸SECURITY · Red Hat Hardened Images updates Tomcat 10 for nine authentication, access-control and DoS flawsRed Hat Errata▸AI · Open Data Hub 3.6.0 EA1 bundles Trainer, MLflow and llm-d componentsOpen Data Hub▸AI · Speculators 0.6.0 adds P-EAGLE parallel drafting for vLLM speculative decodingRed Hat Developer▸SECURITY · OpenShift 4.17.57 fixes seven Go and TLS CVEs in an Important-rated updateRed Hat Errata▸AI · Red Hat benchmarks local LLM guardrails with EvalHub, exposing regex accuracy and latency trade-offsRed Hat Developer▸AI · Red Hat maps silent tool-call failures across agentic pipelinesRed Hat▸API · Kuadrant 1.5.3 adds GRPCRoute policies and developer-portal API-key workflowsKuadrant▸AI · (Aug 25) IBM releases Apache-2.0 Granite 4.2 reasoning models in 3B, 8B and 30B sizesIBM Research▸JAVA · Red Hat build of Quarkus 3.33.3.SP1 fixes 13 CVEs in an Important-rated updateRed Hat errata▸AI · vLLM moves Kimi K2 RL weight sync across 384 H100s in 7.53 seconds (Aug 22)vLLM
upstreambeat.ai
newsSECURITY

Red Hat patches RCE and path traversal flaws in Ansible Automation Platform 2.7

An Important-rated update addresses a GeoDjango remote-code-execution flaw and an automation-controller-cli path traversal issue.

Before-and-after view of Ansible Automation Platform patching path traversal and RCE flaws.
Side by side: what changed
By The News Desk· Aug 24, 2026

Red Hat has issued an Important-rated security update for Ansible Automation Platform 2.7, fixing a remote-code-execution vulnerability in Django and a path traversal flaw in the platform’s command-line tooling. The vendor’s RHSA-2026:59137 advisory was issued August 24 and covers Ansible Automation Platform 2.7 deployments on RHEL 9 and RHEL 10, along with affected Ansible Developer 1.4 and Ansible Inside 1.5 packages.

What the update fixes

The more consequential issue is CVE-2026-15307, which Red Hat describes as remote code execution through GeoDjango spatial lookups. The advisory updates the Django packages bundled with the affected Ansible Automation Platform channels to version 5.2.17 builds. Red Hat lists both the Python and Python 3.12 Django packages among the corrected components.

The same update fixes CVE-2026-52902 in automation-controller-cli. Red Hat says the flaw allows path traversal through the YAML !include directive. Corrected CLI packages are listed as version 4.8.6 builds for the affected RHEL 9 and RHEL 10 channels.

The advisory also rolls forward a broader set of Ansible developer-tool packages, including ansible-creator, ansible-navigator, ansible-lint, Molecule, and the Ansible development environment. Those package updates form part of the security and bug-fix release, but the advisory identifies the Django and controller CLI issues as its security fixes.

Who should act

The affected-product list includes Ansible Automation Platform 2.7 for RHEL 9 and RHEL 10 on x86_64 and aarch64. It also names corresponding Ansible Developer 1.4 builds and Ansible Inside 1.5 on RHEL 9.

Administrators should use the Red Hat advisory to identify the package set for their channel and apply the update through the supported Ansible Automation Platform upgrade process. Because Red Hat rates the combined update Important and one corrected flaw can lead to remote code execution, this is an operational patch rather than a routine tool refresh.

sources

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk