The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of each cloned node and fails to check the instance_groups (and execution_environment and labels) that were preserved from the original. A user with organization workflow-admin permission but no role on the referenced instance groups can copy a workflow, become its administrator, and launch jobs pinned to instance groups they are not authorized to use — including the control-plane instance group — bypassing the InstanceGroup use_role boundary and causing attacker-influenced automation to run in the control-plane execution context.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade receptorUpgrade python3.12-django-ansible-base+api_documentationUpgrade automation-platform-uiUpgrade python3.12-django-ansible-base+channel_authUpgrade automation-eda-controllerUpgrade automation-gateway-configUpgrade receptor-debuginfoUpgrade python3.12-django-ansible-base+rbacUpgrade automation-gateway-serverUpgrade automation-controllerUpgrade python3.12-django-ansible-base+jwt_consumerUpgrade python3.12-django-ansible-base+redis_clientUpgrade python3.12-django-ansible-base+feature_flagsUpgrade python3.12-django-ansible-base+oauth2_providerUpgrade python3.12-gitpythonUpgrade receptor-debugsourceUpgrade python3.12-django-ansible-base+authenticationUpgrade automation-gateway-proxy-serverUpgrade aap-metrics-utilityUpgrade python3.12-django-ansible-baseUpgrade automation-eda-controller-baseUpgrade automation-eda-controller-event-stream-servicesUpgrade python3.12-galaxy-ngUpgrade automation-eda-controller-base-servicesUpgrade automation-gatewayUpgrade receptorctlUpgrade python3.12-django-ansible-base+resource_registryUpgrade automation-controller-uiUpgrade python3-sqlparseUpgrade python3.12-django-ansible-base+activitystreamUpgrade automation-controller-serverUpgrade automation-eda-controller-worker-servicesUpgrade automation-hubUpgrade automation-gateway-proxyUpgrade automation-controller-venv-towerUpgrade python3.12-django-ansible-base+rest_filtersUpgrade python3.12-sqlparseUpgrade automation-controller-cliUpgrade automation-gateway-proxy-server-debuginfoUpgrade automation-gateway-proxy-debugsource | Sep 25, 2026 | Sep 23, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub