Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery

Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process

Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnames

Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracle

Automation-controller: automation-controller: notification.recipients/subject/error lack prevent_search, allowing zero-privilege cross-tenant recovery of notification recipient secrets via filter oracle

Inefficient candidate hostname parsing in crypto/x509

Automation-controller: automation-controller: email notification backend allows ssrf via user-controlled smtp host/port (internal port-scan oracle, smtp password exfil)

Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level instead of use level, allowing execution-placement authorization bypass

Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions

Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templates

Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership

Ansible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expiration

Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structure

Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumeration

Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust

Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler

Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license details via /config/

Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control pod