CVE-2026-52902
CVE-2026-52902: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium4.7
Medium [CVE-2026-52902] Awxkit: path traversal via yaml !include directive
CVE-2026-52902Source published Source updated
A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML!include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.format yaml import". This is a client-side vulnerability requiring user interaction. awxkit as a bundled Python dependency found in ee-supported and platform-resource-runner containers for ansible-automation-platform and as part of the automation-controller RPM. Red Hat severity: Moderate — CVSS 4.7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N). Weakness: CWE-22. Affected Red Hat products: Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat…
- Affected products in this advisory
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Ansible Automation Platform 2.7 for RHEL 10
1 more entries in the full advisory.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- automation-controller-0:4.6.32-1.el8ap
- automation-controller-0:4.6.32-1.el9ap
- automation-controller-0:4.7.16-1.el9ap
- automation-controller-cli-0:4.8.6-1.el10ap
4 more entries in the full advisory.
- Mitigation guidance
- The following practices would help for avoiding exposure to this flaw: 1) Prioritize the default JSON import format instead of YAML. 2) Avoid importing YAML files from untrusted sources.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.