Path Traversal Vulnerability in AWX CLI Tool by Red Hat
CVE-2026-52902
4.7MEDIUM
Key Information:
What is CVE-2026-52902?
A vulnerability exists in the AWX CLI tool (awxkit) that can be exploited through a path traversal flaw within the YAML !include directive. This issue allows an attacker to create a malicious YAML file capable of reading arbitrary YAML-formatted files from the local filesystem when imported using the command 'awx --conf.format yaml import'. Since the vulnerability relies on user interaction for exploitation, it poses significant risks if users are unaware of the potential threats from uncontrolled YAML imports.
Affected Version(s)
Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:4.6.32-1.el8ap
Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:4.6.32-1.el9ap
Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:4.7.16-1.el9ap