The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target template, causing the endpoint to return HTTP 200 for a template that has a Bitbucket DC webhook configured and HTTP 403 otherwise. An unauthenticated remote attacker can use this response discrepancy as an oracle to enumerate which Job Template and Workflow Job Template IDs have Bitbucket DC webhooks configured, without knowing the secret webhook_key.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade automation-controller-uiUpgrade python3.12-gitpythonUpgrade automation-eda-controller-base-servicesUpgrade python3-sqlparseUpgrade automation-controller-cliUpgrade automation-platform-uiUpgrade python3.12-django-ansible-base+resource_registryUpgrade automation-eda-controller-baseUpgrade python3.12-django-ansible-base+feature_flagsUpgrade python3.12-django-ansible-base+jwt_consumerUpgrade automation-controllerUpgrade automation-gatewayUpgrade python3.12-galaxy-ngUpgrade automation-gateway-proxy-serverUpgrade automation-eda-controllerUpgrade python3.12-django-ansible-base+rest_filtersUpgrade receptorctlUpgrade automation-gateway-proxyUpgrade automation-controller-serverUpgrade automation-controller-venv-towerUpgrade python3.12-django-ansible-base+authenticationUpgrade automation-gateway-configUpgrade automation-gateway-proxy-debugsourceUpgrade automation-eda-controller-event-stream-servicesUpgrade receptor-debuginfoUpgrade python3.12-django-ansible-base+redis_clientUpgrade python3.12-django-ansible-base+channel_authUpgrade receptorUpgrade python3.12-django-ansible-base+rbacUpgrade automation-eda-controller-worker-servicesUpgrade python3.12-sqlparseUpgrade receptor-debugsourceUpgrade automation-gateway-serverUpgrade python3.12-django-ansible-base+oauth2_providerUpgrade automation-gateway-proxy-server-debuginfoUpgrade aap-metrics-utilityUpgrade python3.12-django-ansible-base+activitystreamUpgrade automation-hubUpgrade python3.12-django-ansible-baseUpgrade python3.12-django-ansible-base+api_documentation | Sep 25, 2026 | Sep 23, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub