RHSA-2026:80603
Vulnerability from csaf_redhat - Published: 2026-10-12 05:44 - Updated: 2026-10-13 12:31Summary
Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update
Severity
Critical
Notes
Topic: Updated images are now available for Red Hat Ansible Automation Platform 2.1, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub.
Details: Red Hat Ansible Automation Platform 2.1 delivers an Ansible-first Red Hat Developer Hub
user experience that simplifies the automation experience for Ansible users of all skill levels.
The Ansible plug-ins provide curated content and features to accelerate Ansible learner
onboarding and streamline Ansible use case adoption across your organization.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in vm2. The sandbox fails to properly sanitize the error cause property when handling exceptions thrown by host functions. An attacker capable of running untrusted code within the sandbox can exploit this issue to access privileged host objects and bypass isolation boundaries. Consequently, this flaw allows the attacker to escape the sandbox and achieve arbitrary code execution on the underlying host system.
9.9 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in vm2. This vulnerability allows arbitrary code execution on the host system through a sandbox breakout. An attacker capable of running code inside the sandbox can manipulate host object properties using indirect function calls to bypass isolation boundaries and execute arbitrary commands directly on the host.
9.8 (Critical)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Important
A flaw was found in undici's BalancedPool component. This vulnerability allows a remote attacker to bypass Transport Layer Security (TLS) certificate validation. The BalancedPool constructor incorrectly processes its options, silently discarding custom certificate validation functions. Consequently, a peer with an otherwise untrusted certificate may be accepted, potentially compromising the integrity of secure communication.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Important
A flaw was found in undici. When the cache or deduplicate interceptor is directly composed onto a Client or Pool, the destination origin is omitted from cache and request-deduplication keys. This allows a remote attacker to perform cross-origin cache poisoning, leading to information disclosure and potentially a full authentication bypass. An attacker could exploit this by having a trusted origin accept a malicious token, without contacting the legitimate trusted origin.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Important
A flaw was found in vm2. A remote attacker able to run code within the sandbox can bypass environment isolation by exploiting an error handling flaw that fails to properly sanitize host objects. By accessing these unprotected host objects, an attacker can achieve arbitrary code execution and access sensitive information on the underlying host system.
9.0 (Critical)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Important
A flaw was found in vm2. This vulnerability allows an attacker who can execute untrusted JavaScript inside the sandbox to achieve arbitrary code execution on the host system. By providing an array value to the require configuration when nested sandboxes are enabled, the attacker can bypass isolation boundaries. Consequently, the attacker can escape sandbox containment and execute unauthorized commands with the privileges of the underlying Node.js process.
9.0 (Critical)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Important
A flaw was found in vm2. This vulnerability allows an attacker to escape the sandbox environment and achieve arbitrary code execution on the host system. The issue occurs because the sandbox bridge fails to properly sanitize rejected Promise errors when handlers are registered through indirect function calls. By triggering an unhandled rejection containing host references, untrusted code within the sandbox can access host objects and execute arbitrary commands with the privileges of the host process.
8.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Important
A flaw was found in vm2. Untrusted code running within the sandbox environment can bypass isolation restrictions when the host SQLite module is accessible. By crafting module import requests and loading native database extensions, an attacker can escape the sandbox and achieve arbitrary code execution with the privileges of the host process.
9.9 (Critical)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Important
A flaw was found in vm2. When the cryptographic built-in module is enabled, functions exposed to the sandbox continue to run with the privileges of the host process. An attacker capable of running untrusted code within the sandbox can invoke the crypto.setEngine() function to load a malicious local library, escaping the sandbox and achieving arbitrary code execution on the host system.
9.9 (Critical)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Important
A flaw was found in vm2. When a sandbox is configured to permit HTTPS requests, it improperly exposes the host process's network connection manager to sandboxed code. An attacker running untrusted code within the sandbox can exploit this flaw to intercept pooled network connections released by the host application. This allows the attacker to capture sensitive authentication credentials, inspect plaintext communication, and issue unauthorized requests using the stolen credentials.
8.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Important
A flaw was found in vm2. The sandbox improperly exposes the host Transport Layer Security (TLS) module to untrusted code running within the sandbox environment. An attacker can exploit this issue using allowed built-in utilities to modify the process-wide certificate authorities. This manipulation causes the host application to trust attacker-controlled security certificates, potentially allowing secure network communications to be intercepted or spoofed.
9.9 (Critical)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Important
A flaw was found in vm2. An attacker capable of running code within the sandbox environment can bypass security wrappers by supplying a crafted asynchronous Promise object. This flaw allows the attacker to escape the sandbox and access host system objects, leading to arbitrary code execution on the underlying host.
9.8 (Critical)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Important
A flaw was found in vm2. This vulnerability allows an attacker executing untrusted code within the sandbox to escape isolation and achieve arbitrary code execution on the host system. When external module loading is permitted without restricting access to dependency directories, sandboxed code can load vm2 itself, create an unrestricted virtual machine environment, and run arbitrary host operating system commands.
8.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Important
A flaw was found in vm2. The sandbox environment inadvertently exposes the host system's shared memory buffer pool to sandboxed code. An attacker running untrusted code inside the sandbox can access and modify these shared buffers, resulting in unauthorized information disclosure of host memory or a potential Denial of Service (DoS).
8.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Important
A flaw was found in vm2. This vulnerability allows an attacker with permission to run code inside the sandbox to escape containment and achieve arbitrary code execution on the host system. Due to improper validation of built-in module names, the sandbox fails to block access to sensitive host functions. An attacker can exploit this issue by supplying a specially crafted module identifier, allowing them to spawn an unrestricted process on the host.
9.9 (Critical)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Important
A flaw was found in vm2. An attacker can achieve arbitrary code execution on the host system by escaping sandbox isolation through the command-line interface (CLI) tool. By supplying a malicious script that uses the require() function to re-execute itself within the host environment, untrusted code can bypass security boundaries to access host modules and files.
8.6 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Important
A flaw was found in vm2. The external package allowlist improperly validates package names using substring matching rather than exact name boundaries. An attacker capable of running code within the sandbox can exploit this issue by requesting a package name containing an allowlisted substring, allowing them to load unauthorized host packages and execute arbitrary code outside the sandbox.
9.9 (Critical)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Important
A flaw was found in vm2. The sandbox fails to properly isolate host object structures from untrusted code running inside the virtual machine. An attacker can exploit this issue by manipulating object prototype chains to modify shared host prototypes, resulting in prototype pollution (the unauthorized alteration of base object properties). This flaw allows an attacker to compromise the integrity of host-created objects after execution completes, potentially leading to unauthorized data alteration or a denial of service (DoS).
9.3 (Critical)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Important
A flaw was found in vm2. An attacker capable of running untrusted code within the sandbox can trigger a Denial of Service (DoS) by causing the host application process to terminate. This vulnerability exists because asynchronous operations (Promises) returned from the host environment are not properly marked as handled across the sandbox boundary. By invoking a host function that returns a rejected Promise and ignoring its return value, the unhandled rejection causes the underlying Node.js runtime to crash.
8.6 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Important
A flaw was found in vm2. When running untrusted code within a sandbox, improper isolation in WebAssembly streaming functions allows host error objects to leak into the sandbox environment. An attacker capable of running code inside the sandbox can exploit this flaw to escape sandbox containment and achieve arbitrary code execution on the underlying host system.
9.9 (Critical)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Important
A flaw was found in vm2. Untrusted code running within the sandbox can bypass module restriction policies to achieve arbitrary code execution on the underlying host. Due to improper normalization of module names containing the node: prefix, deny-list rules fail to prevent access to sensitive built-in modules such as child_process. An attacker can exploit this vulnerability to escape the sandbox and execute commands directly on the host system.
9.9 (Critical)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Important
A flaw was found in vm2. In configurations allowing built-in modules, vm2 fails to restrict access to the host operating system and Domain Name System (DNS) modules. An attacker who can execute code inside the sandbox can exploit this flaw to hijack the host process DNS resolver, redirecting outbound network queries to an attacker-controlled server. Additionally, this flaw allows the attacker to obtain sensitive host system information, such as process credentials and network topology, or alter process execution priorities.
8.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Important
A flaw was found in vm2. This vulnerability allows an attacker who can execute untrusted script within the sandbox to achieve arbitrary code execution on the underlying host system by escaping sandbox containment. The issue occurs because vm2 fails to properly handle function calls lacking an object receiver, causing the JavaScript runtime to expose the host environment's global object to the sandboxed code.
9.8 (Critical)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Critical
A flaw was found in vm2. Untrusted guest code can exploit this vulnerability when the `crypto` builtin is explicitly allowlisted for a NodeVM (Node.js Virtual Machine). By calling the `crypto.setFips()` function, an attacker can modify the FIPS (Federal Information Processing Standards) mode of the entire host process. This allows guest code to bypass the NodeVM isolation boundary, leading to a sandbox escape and potentially impacting the integrity of the host system.
7.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Important
A flaw was found in vm2. The sandbox environment fails to restrict access to the child_process module, which handles system command execution. In environments configured to allow built-in modules, an attacker capable of running untrusted code within the sandbox can load this module to break containment. This can result in arbitrary code execution on the underlying host system.
9.8 (Critical)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Critical
A flaw was found in vm2. An attacker running untrusted code within the sandbox can bypass isolation controls to achieve arbitrary code execution on the host system. This issue is caused by improper sanitization of host Promise objects, which allows sandboxed scripts to manipulate Promise constructor properties and obtain direct references to sensitive host-level objects. Consequently, an attacker can break out of the restricted sandbox environment and fully compromise the host.
9.8 (Critical)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Critical
A flaw was found in grpc-js. In configurations where client certificates are optional, the authentication context lookup fails to distinguish between authorized and unauthorized peer certificates. A remote attacker can exploit this vulnerability by presenting an untrusted certificate, allowing them to bypass authentication mechanisms and access protected services.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-47686
Threats
Impact
Important
References
198 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated images are now available for Red Hat Ansible Automation Platform 2.1, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Ansible Automation Platform 2.1 delivers an Ansible-first Red Hat Developer Hub\nuser experience that simplifies the automation experience for Ansible users of all skill levels.\nThe Ansible plug-ins provide curated content and features to accelerate Ansible learner\nonboarding and streamline Ansible use case adoption across your organization.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:80603",
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-101916",
"url": "https://access.redhat.com/security/cve/CVE-2026-101916"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47686",
"url": "https://access.redhat.com/security/cve/CVE-2026-47686"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47698",
"url": "https://access.redhat.com/security/cve/CVE-2026-47698"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-84961",
"url": "https://access.redhat.com/security/cve/CVE-2026-84961"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-85152",
"url": "https://access.redhat.com/security/cve/CVE-2026-85152"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92934",
"url": "https://access.redhat.com/security/cve/CVE-2026-92934"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92935",
"url": "https://access.redhat.com/security/cve/CVE-2026-92935"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92937",
"url": "https://access.redhat.com/security/cve/CVE-2026-92937"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92938",
"url": "https://access.redhat.com/security/cve/CVE-2026-92938"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92939",
"url": "https://access.redhat.com/security/cve/CVE-2026-92939"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92940",
"url": "https://access.redhat.com/security/cve/CVE-2026-92940"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92941",
"url": "https://access.redhat.com/security/cve/CVE-2026-92941"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92944",
"url": "https://access.redhat.com/security/cve/CVE-2026-92944"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92946",
"url": "https://access.redhat.com/security/cve/CVE-2026-92946"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92947",
"url": "https://access.redhat.com/security/cve/CVE-2026-92947"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92948",
"url": "https://access.redhat.com/security/cve/CVE-2026-92948"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92950",
"url": "https://access.redhat.com/security/cve/CVE-2026-92950"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92951",
"url": "https://access.redhat.com/security/cve/CVE-2026-92951"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92953",
"url": "https://access.redhat.com/security/cve/CVE-2026-92953"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92954",
"url": "https://access.redhat.com/security/cve/CVE-2026-92954"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92956",
"url": "https://access.redhat.com/security/cve/CVE-2026-92956"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92957",
"url": "https://access.redhat.com/security/cve/CVE-2026-92957"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-92960",
"url": "https://access.redhat.com/security/cve/CVE-2026-92960"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-93603",
"url": "https://access.redhat.com/security/cve/CVE-2026-93603"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-93604",
"url": "https://access.redhat.com/security/cve/CVE-2026-93604"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-93605",
"url": "https://access.redhat.com/security/cve/CVE-2026-93605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-93606",
"url": "https://access.redhat.com/security/cve/CVE-2026-93606"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform",
"url": "https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80603.json"
}
],
"title": "Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update",
"tracking": {
"current_release_date": "2026-10-13T12:31:30+00:00",
"generator": {
"date": "2026-10-13T12:31:30+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.2"
}
},
"id": "RHSA-2026:80603",
"initial_release_date": "2026-10-12T05:44:41+00:00",
"revision_history": [
{
"date": "2026-10-12T05:44:41+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-10-12T05:44:44+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-13T12:31:30+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Ansible Automation Platform 2.1",
"product": {
"name": "Red Hat Ansible Automation Platform 2.1",
"product_id": "Red Hat Ansible Automation Platform 2.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ansible_portal:2.1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Ansible Automation Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64",
"product": {
"name": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64",
"product_id": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64",
"product_identification_helper": {
"purl": "pkg:oci/automation-portal@sha256%3Af92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59?arch=amd64\u0026repository_url=registry.redhat.io/ansible-automation-platform/automation-portal\u0026tag=1791295379"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64 as a component of Red Hat Ansible Automation Platform 2.1",
"product_id": "Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
},
"product_reference": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64",
"relates_to_product_reference": "Red Hat Ansible Automation Platform 2.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-47686",
"cwe": {
"id": "CWE-693",
"name": "Protection Mechanism Failure"
},
"discovery_date": "2026-08-17T21:10:58.603426+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517639"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. The sandbox fails to properly sanitize the error cause property when handling exceptions thrown by host functions. An attacker capable of running untrusted code within the sandbox can exploit this issue to access privileged host objects and bypass isolation boundaries. Consequently, this flaw allows the attacker to escape the sandbox and achieve arbitrary code execution on the underlying host system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having an Important impact for Red Hat products because an attacker capable of executing untrusted scripts within the sandbox environment can escape isolation and execute arbitrary commands in the host process. Successful exploitation requires specific preconditions, namely that an embedder-provided host function exposes chained error objects referencing privileged runtime structures. Consequently, the blast radius allows full host process compromise, though execution depends on the presence and invocation of these specific host error paths.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47686"
},
{
"category": "external",
"summary": "RHBZ#2517639",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517639"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47686",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47686"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47686",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47686"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/commit/7e3faaf550f4ab975bf4cdde183fcec49b056d8e",
"url": "https://github.com/patriksimek/vm2/commit/7e3faaf550f4ab975bf4cdde183fcec49b056d8e"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/releases/tag/3.11.6",
"url": "https://github.com/patriksimek/vm2/releases/tag/3.11.6"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-m283-3h24-438v",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-m283-3h24-438v"
}
],
"release_date": "2026-08-17T20:54:39.406000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vm2: vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE"
},
{
"cve": "CVE-2026-47698",
"cwe": {
"id": "CWE-913",
"name": "Improper Control of Dynamically-Managed Code Resources"
},
"discovery_date": "2026-08-17T21:11:37.628946+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517646"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. This vulnerability allows arbitrary code execution on the host system through a sandbox breakout. An attacker capable of running code inside the sandbox can manipulate host object properties using indirect function calls to bypass isolation boundaries and execute arbitrary commands directly on the host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2: Sandbox Breakout Using Dangerous Host Proto Mutators",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has rated this vulnerability as having an Important severity because it permits an attacker to escape sandbox confinement and achieve arbitrary command execution under the privileges of the hosting application. To trigger this vulnerability, an attacker must have the ability to submit untrusted JavaScript into a service that relies on the vm2 execution engine. In Red Hat environments such as Red Hat Developer Hub and Ansible Automation Platform, exposure is confined to components evaluating user-provided scripts, limiting direct remote risk where script submission is restricted to authenticated, trusted operators.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47698"
},
{
"category": "external",
"summary": "RHBZ#2517646",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517646"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47698",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47698"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47698",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47698"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/commit/a85acb61f81402c6eabf32760aa11272af6d0f9e",
"url": "https://github.com/patriksimek/vm2/commit/a85acb61f81402c6eabf32760aa11272af6d0f9e"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/releases/tag/3.11.6",
"url": "https://github.com/patriksimek/vm2/releases/tag/3.11.6"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-cfcw-xp6x-25gj",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-cfcw-xp6x-25gj"
}
],
"release_date": "2026-08-17T20:53:09.218000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vm2: vm2: Sandbox Breakout Using Dangerous Host Proto Mutators"
},
{
"cve": "CVE-2026-84961",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-09-04T16:52:40.440125+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528735"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici\u0027s BalancedPool component. This vulnerability allows a remote attacker to bypass Transport Layer Security (TLS) certificate validation. The BalancedPool constructor incorrectly processes its options, silently discarding custom certificate validation functions. Consequently, a peer with an otherwise untrusted certificate may be accepted, potentially compromising the integrity of secure communication.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw only affects applications that construct an undici BalancedPool with a function-valued connect or tls option \u2014 for example, a custom checkServerIdentity callback or connector used for certificate pinning across multiple upstreams. Client, Pool, Agent, and RoundRobinPool destructure these options before the internal JSON-based clone and are not affected. An attacker able to present, on the network path, a TLS endpoint whose certificate the application\u0027s custom validator was written to reject \u2014 but which still satisfies Node.js\u0027s default hostname and chain checks \u2014 can have that certificate silently accepted when the connection goes through BalancedPool, enabling a man-in-the-middle attack against affected connections.\nThis affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-84961"
},
{
"category": "external",
"summary": "RHBZ#2528735",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528735"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-84961",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84961"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84961",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84961"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3"
}
],
"release_date": "2026-09-04T16:47:55.724000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Applications that do not use BalancedPool, or that use it without a custom function-valued connect/tls option, are not affected and require no action. As a workaround until packages are updated, avoid using BalancedPool for any connection that relies on custom TLS certificate validation (e.g. certificate pinning); use Client, Pool, or Agent instead, which are unaffected. The permanent fix is upgrading undici to 7.29.1 or later (7.x line) or 8.10.2 or later (8.x line).",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options"
},
{
"cve": "CVE-2026-85152",
"cwe": {
"id": "CWE-346",
"name": "Origin Validation Error"
},
"discovery_date": "2026-09-04T16:41:35.623977+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528717"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. When the cache or deduplicate interceptor is directly composed onto a Client or Pool, the destination origin is omitted from cache and request-deduplication keys. This allows a remote attacker to perform cross-origin cache poisoning, leading to information disclosure and potentially a full authentication bypass. An attacker could exploit this by having a trusted origin accept a malicious token, without contacting the legitimate trusted origin.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is present in the undici HTTP client library used by Node.js. When an application composes undici\u0027s Cache or Deduplicate interceptor directly onto a Client or Pool object (rather than onto an Agent), the library\u0027s internal cache and in-flight-request deduplication keys omit the destination origin. As a result, a cached or in-flight response captured for one upstream origin can be returned for a request intended for a different, trusted origin whenever the method, path, and relevant headers match. In the most severe demonstrated scenario, this allowed an attacker-controlled JWT to be accepted by the application as though it had been validated against a legitimate, trusted issuer, without that issuer ever being contacted \u2014 resulting in a full authentication bypass.\nExploitation requires that the affected application attach the Cache or Deduplicate interceptor directly to a Client/Pool \u2014 the default Agent-based dispatch path is not affected, since Agent already carries the origin in its dispatch options \u2014 and that an attacker can influence or collide with the cache/deduplication key for at least one origin the application communicates with.).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-85152"
},
{
"category": "external",
"summary": "RHBZ#2528717",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528717"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-85152",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-85152"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85152",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85152"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-vp8m-p9jh-q5pm",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-vp8m-p9jh-q5pm"
}
],
"release_date": "2026-09-04T16:36:28.085000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible to undici 8.10.2 or later.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation"
},
{
"cve": "CVE-2026-92934",
"cwe": {
"id": "CWE-693",
"name": "Protection Mechanism Failure"
},
"discovery_date": "2026-09-17T13:59:06.679469+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536048"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. A remote attacker able to run code within the sandbox can bypass environment isolation by exploiting an error handling flaw that fails to properly sanitize host objects. By accessing these unprotected host objects, an attacker can achieve arbitrary code execution and access sensitive information on the underlying host system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2 before 3.11.8 Sandbox Escape RCE via AggregateError",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity rather than Critical because exploitation is contingent upon an application allowing untrusted JavaScript execution within the vm2 sandbox, requiring specific preconditions and complex exception-handling manipulation to achieve breakout. In supported Red Hat offerings such as Red Hat Developer Hub and Ansible Automation Platform, internal Node.js services utilizing vm2 to isolate dynamic script execution can be compromised if an attacker submits specially crafted payloads. A successful escape breaks out of the intended sandbox boundaries into the underlying container or host environment, compromising the confidentiality, integrity, and availability of the host process.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92934"
},
{
"category": "external",
"summary": "RHBZ#2536048",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536048"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92934",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92934"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92934",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92934"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-x965-fc75-jpqh",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-x965-fc75-jpqh"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/vm2-before-3.11.8-sandbox-escape-rce-via-aggregateerror",
"url": "https://www.vulncheck.com/advisories/vm2-before-3.11.8-sandbox-escape-rce-via-aggregateerror"
}
],
"release_date": "2026-09-17T13:46:00.130000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vm2: vm2 before 3.11.8 Sandbox Escape RCE via AggregateError"
},
{
"cve": "CVE-2026-92935",
"cwe": {
"id": "CWE-913",
"name": "Improper Control of Dynamically-Managed Code Resources"
},
"discovery_date": "2026-09-17T13:56:05.169836+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536041"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. This vulnerability allows an attacker who can execute untrusted JavaScript inside the sandbox to achieve arbitrary code execution on the host system. By providing an array value to the require configuration when nested sandboxes are enabled, the attacker can bypass isolation boundaries. Consequently, the attacker can escape sandbox containment and execute unauthorized commands with the privileges of the underlying Node.js process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2 NodeVM Remote Code Execution via Array-Shaped Require",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having an Important severity rather than Critical because exploitation requires the host application to instantiate the sandbox under specific, non-default conditions enabling nested execution. In Red Hat environments, the affected component is bundled within select containerized services, including Red Hat Developer Hub and Ansible Automation Platform, to isolate dynamic code execution. Under vulnerable configurations, an untrusted user able to submit custom scripts can escape the sandbox boundaries and run arbitrary commands with the permissions of the parent Node.js container process. Environments where user-supplied script evaluation is disabled or where sandbox nesting is not permitted are not susceptible to this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92935"
},
{
"category": "external",
"summary": "RHBZ#2536041",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536041"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92935",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92935"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92935",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92935"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/commit/54b54b74a382577f0bcd0538c5bf99acdcd7f53b",
"url": "https://github.com/patriksimek/vm2/commit/54b54b74a382577f0bcd0538c5bf99acdcd7f53b"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-8hr7-r645-pc6w",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-8hr7-r645-pc6w"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/vm2-nodevm-remote-code-execution-via-array-shaped-require",
"url": "https://www.vulncheck.com/advisories/vm2-nodevm-remote-code-execution-via-array-shaped-require"
}
],
"release_date": "2026-09-17T13:46:00.854000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vm2: vm2 NodeVM Remote Code Execution via Array-Shaped Require"
},
{
"cve": "CVE-2026-92937",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-09-17T13:53:35.239408+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536033"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. This vulnerability allows an attacker to escape the sandbox environment and achieve arbitrary code execution on the host system. The issue occurs because the sandbox bridge fails to properly sanitize rejected Promise errors when handlers are registered through indirect function calls. By triggering an unhandled rejection containing host references, untrusted code within the sandbox can access host objects and execute arbitrary commands with the privileges of the host process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2 3.11.6 Remote Code Execution via Promise call/apply",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity because it enables untrusted code running within the isolated runtime to escape sandboxing and execute arbitrary commands under the host process privileges. Although sandbox escapes present significant risk, successful exploitation requires the host application to bridge asynchronous operations that reject with host-referencing error objects into the sandbox. In supported Red Hat environments such as Red Hat Developer Hub and Ansible Automation Platform, execution occurs within containerized microservices, limiting the broader host impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92937"
},
{
"category": "external",
"summary": "RHBZ#2536033",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536033"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92937",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92937"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92937",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92937"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-647f-g98j-qq25",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-647f-g98j-qq25"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/vm2-3.11.6-remote-code-execution-via-promise-call-apply",
"url": "https://www.vulncheck.com/advisories/vm2-3.11.6-remote-code-execution-via-promise-call-apply"
}
],
"release_date": "2026-09-17T13:46:02.195000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vm2: vm2 3.11.6 Remote Code Execution via Promise call/apply"
},
{
"cve": "CVE-2026-92938",
"cwe": {
"id": "CWE-693",
"name": "Protection Mechanism Failure"
},
"discovery_date": "2026-09-17T13:57:54.490525+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536047"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. Untrusted code running within the sandbox environment can bypass isolation restrictions when the host SQLite module is accessible. By crafting module import requests and loading native database extensions, an attacker can escape the sandbox and achieve arbitrary code execution with the privileges of the host process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because an attacker capable of submitting untrusted scripts to an environment using the vm2 sandbox can escape isolation and execute arbitrary code in the context of the underlying host process. Red Hat products such as Red Hat Developer Hub and Ansible Automation Platform bundle this library within specific backend services to execute isolated routines. While escaping the sandbox compromises host process integrity and confidentiality, exploitation requires pre-existing privileges to provide or load sandboxed code alongside specific configuration allowances for the builtin SQLite module.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92938"
},
{
"category": "external",
"summary": "RHBZ#2536047",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536047"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92938",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92938"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92938",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92938"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-6w8r-xxw2-g3hx",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-6w8r-xxw2-g3hx"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/vm2-3.11.3-through-3.11.6-remote-code-execution-via-node-sqlite",
"url": "https://www.vulncheck.com/advisories/vm2-3.11.3-through-3.11.6-remote-code-execution-via-node-sqlite"
}
],
"release_date": "2026-09-17T13:46:02.866000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vm2: vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite"
},
{
"cve": "CVE-2026-92939",
"cwe": {
"id": "CWE-114",
"name": "Process Control"
},
"discovery_date": "2026-09-17T13:58:31.170475+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536050"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. When the cryptographic built-in module is enabled, functions exposed to the sandbox continue to run with the privileges of the host process. An attacker capable of running untrusted code within the sandbox can invoke the crypto.setEngine() function to load a malicious local library, escaping the sandbox and achieving arbitrary code execution on the host system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important rather than Critical because successful exploitation requires specific environmental prerequisites, including the allowance of the built-in cryptographic module within the execution sandbox and the presence of an attacker-controlled shared library on the local filesystem. In affected Red Hat products, such as Red Hat Developer Hub and Ansible Automation Platform, sandbox execution is generally limited to authenticated users or managed automation tasks. Under vulnerable configurations, breaking sandbox isolation compromises the host process, potentially allowing attackers to execute native code with container privileges.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92939"
},
{
"category": "external",
"summary": "RHBZ#2536050",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536050"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92939",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92939"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92939",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92939"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-46pr-c5wc-xffx",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-46pr-c5wc-xffx"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/vm2-3.11.3-through-3.11.6-native-code-execution-via-crypto-setengine",
"url": "https://www.vulncheck.com/advisories/vm2-3.11.3-through-3.11.6-native-code-execution-via-crypto-setengine"
}
],
"release_date": "2026-09-17T13:46:03.558000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vm2: vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine"
},
{
"cve": "CVE-2026-92940",
"cwe": {
"id": "CWE-668",
"name": "Exposure of Resource to Wrong Sphere"
},
"discovery_date": "2026-09-17T13:53:51.249505+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536034"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. When a sandbox is configured to permit HTTPS requests, it improperly exposes the host process\u0027s network connection manager to sandboxed code. An attacker running untrusted code within the sandbox can exploit this flaw to intercept pooled network connections released by the host application. This allows the attacker to capture sensitive authentication credentials, inspect plaintext communication, and issue unauthorized requests using the stolen credentials.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important impact because it permits sandboxed code to breach process isolation boundaries and compromise sensitive authentication credentials used by the host application. In Red Hat products utilizing vm2 within service plugins, untrusted scripts granted access to network functionality can snoop on pooled connection agents to capture session headers and intercept outbound network traffic. Although this constitutes a significant confidentiality and integrity breach across the security perimeter, successful exploitation depends on specific sandbox configurations that expose native network capabilities to untrusted execution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92940"
},
{
"category": "external",
"summary": "RHBZ#2536034",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536034"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92940",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92940"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92940",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92940"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-h85j-hv3c-qfgq",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-h85j-hv3c-qfgq"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/vm2-3.11.3-through-3.11.6-https-credential-exposure-via-globalagent",
"url": "https://www.vulncheck.com/advisories/vm2-3.11.3-through-3.11.6-https-credential-exposure-via-globalagent"
}
],
"release_date": "2026-09-17T13:46:04.218000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vm2: vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent"
},
{
"cve": "CVE-2026-92941",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"discovery_date": "2026-09-17T13:51:17.370374+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. The sandbox improperly exposes the host Transport Layer Security (TLS) module to untrusted code running within the sandbox environment. An attacker can exploit this issue using allowed built-in utilities to modify the process-wide certificate authorities. This manipulation causes the host application to trust attacker-controlled security certificates, potentially allowing secure network communications to be intercepted or spoofed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important rather than Critical because successful exploitation requires the capability to execute code within an isolated sandbox environment, yet it allows compromising TLS trust validation for the entire host process. In Red Hat deployments where untrusted scripts are evaluated inside application sandboxes, a compromised runtime can be forced to trust arbitrary certificate authorities, enabling interception of outbound secure connections. Red Hat products that bundle affected sandbox components, including Red Hat Developer Hub and Red Hat Ansible Automation Platform, are exposed when untrusted execution workloads are permitted.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92941"
},
{
"category": "external",
"summary": "RHBZ#2536026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92941",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92941"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92941",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92941"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-98xx-8mx4-x7cm",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-98xx-8mx4-x7cm"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/vm2-3.11.3-before-3.11.7-tls-trust-store-manipulation",
"url": "https://www.vulncheck.com/advisories/vm2-3.11.3-before-3.11.7-tls-trust-store-manipulation"
}
],
"release_date": "2026-09-17T13:46:04.885000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vm2: vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation"
},
{
"cve": "CVE-2026-92944",
"cwe": {
"id": "CWE-693",
"name": "Protection Mechanism Failure"
},
"discovery_date": "2026-09-17T13:56:56.808663+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536044"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. An attacker capable of running code within the sandbox environment can bypass security wrappers by supplying a crafted asynchronous Promise object. This flaw allows the attacker to escape the sandbox and access host system objects, leading to arbitrary code execution on the underlying host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having an Important severity because escaping the sandbox breaks the primary security boundary of the environment, granting an attacker the ability to execute code within the context of the host process. In Red Hat environments such as Red Hat Developer Hub and Ansible Automation Platform, vm2 is embedded within backend container services, meaning exposure depends on workloads evaluating untrusted user-supplied scripts. A successful compromise allows arbitrary operations under the permissions of the hosting service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92944"
},
{
"category": "external",
"summary": "RHBZ#2536044",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536044"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92944",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92944"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92944",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92944"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/commit/4635ddd85839461c8ad791990023a477efefe7bd",
"url": "https://github.com/patriksimek/vm2/commit/4635ddd85839461c8ad791990023a477efefe7bd"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/commit/7b26e81087ec88c287d9a4812f969d412f32774e",
"url": "https://github.com/patriksimek/vm2/commit/7b26e81087ec88c287d9a4812f969d412f32774e"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-27g9-p43v-cw3v",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-27g9-p43v-cw3v"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/vm2-3.10.2-through-3.11.6-sandbox-escape-via-promise-protector",
"url": "https://www.vulncheck.com/advisories/vm2-3.10.2-through-3.11.6-sandbox-escape-via-promise-protector"
}
],
"release_date": "2026-09-17T13:46:06.201000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vm2: vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector"
},
{
"cve": "CVE-2026-92946",
"cwe": {
"id": "CWE-913",
"name": "Improper Control of Dynamically-Managed Code Resources"
},
"discovery_date": "2026-09-17T13:54:07.689635+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536035"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. This vulnerability allows an attacker executing untrusted code within the sandbox to escape isolation and achieve arbitrary code execution on the host system. When external module loading is permitted without restricting access to dependency directories, sandboxed code can load vm2 itself, create an unrestricted virtual machine environment, and run arbitrary host operating system commands.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2 before 3.11.7 Remote Code Execution via require.external",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity flaw because an attacker capable of submitting untrusted code to the evaluation sandbox can escape isolation boundaries and execute arbitrary commands with the privileges of the underlying host process. Within affected Red Hat offerings, including Red Hat Developer Hub and Ansible Automation Platform components, vm2 is utilized to execute scripts within a restricted runtime. If external module loading is permitted without directory restrictions, malicious input can breach the sandbox and compromise the container environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92946"
},
{
"category": "external",
"summary": "RHBZ#2536035",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536035"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92946",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92946"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92946",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92946"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-j3hm-6rg5-mchv",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-j3hm-6rg5-mchv"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/vm2-before-3.11.7-remote-code-execution-via-require-external",
"url": "https://www.vulncheck.com/advisories/vm2-before-3.11.7-remote-code-execution-via-require-external"
}
],
"release_date": "2026-09-17T13:46:07.498000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vm2: vm2 before 3.11.7 Remote Code Execution via require.external"
},
{
"cve": "CVE-2026-92947",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2026-09-17T13:54:27.475211+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536037"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. The sandbox environment inadvertently exposes the host system\u0027s shared memory buffer pool to sandboxed code. An attacker running untrusted code inside the sandbox can access and modify these shared buffers, resulting in unauthorized information disclosure of host memory or a potential Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2 before 3.11.7 Memory Disclosure via Buffer Pool",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity flaw because an attacker capable of executing arbitrary code within a sandboxed runtime can breach isolation boundaries, accessing and modifying data stored in host-realm memory. In affected Red Hat products, services running untrusted JavaScript inside sandboxed containers or processes risk exposure of adjacent host memory contents and potential service disruption. Exploitation requires an attacker to have the ability to supply and execute untrusted code within the sandbox environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92947"
},
{
"category": "external",
"summary": "RHBZ#2536037",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536037"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92947",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92947"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92947",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92947"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/vm2-before-3.11.7-memory-disclosure-via-buffer-pool",
"url": "https://www.vulncheck.com/advisories/vm2-before-3.11.7-memory-disclosure-via-buffer-pool"
}
],
"release_date": "2026-09-17T13:46:08.167000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vm2: vm2 before 3.11.7 Memory Disclosure via Buffer Pool"
},
{
"cve": "CVE-2026-92948",
"cwe": {
"id": "CWE-693",
"name": "Protection Mechanism Failure"
},
"discovery_date": "2026-09-17T14:00:56.444705+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536058"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. This vulnerability allows an attacker with permission to run code inside the sandbox to escape containment and achieve arbitrary code execution on the host system. Due to improper validation of built-in module names, the sandbox fails to block access to sensitive host functions. An attacker can exploit this issue by supplying a specially crafted module identifier, allowing them to spawn an unrestricted process on the host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92948"
},
{
"category": "external",
"summary": "RHBZ#2536058",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536058"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92948",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92948"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92948",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92948"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-qhwx-74w5-xhxq",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-qhwx-74w5-xhxq"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/vm2-3.9.6-through-3.11.5-sandbox-escape-via-node-test",
"url": "https://www.vulncheck.com/advisories/vm2-3.9.6-through-3.11.5-sandbox-escape-via-node-test"
}
],
"release_date": "2026-09-17T13:46:08.814000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vm2: vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test"
},
{
"cve": "CVE-2026-92950",
"cwe": {
"id": "CWE-453",
"name": "Insecure Default Variable Initialization"
},
"discovery_date": "2026-09-17T13:59:22.000627+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536053"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. An attacker can achieve arbitrary code execution on the host system by escaping sandbox isolation through the command-line interface (CLI) tool. By supplying a malicious script that uses the require() function to re-execute itself within the host environment, untrusted code can bypass security boundaries to access host modules and files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2 before 3.11.7 Sandbox Escape via CLI require",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity rather than Critical because successful exploitation requires direct invocation of the vm2 command-line interface with user-controlled input, rather than standard programmatic library execution. In Red Hat deployments such as Red Hat Developer Hub and Ansible Automation Platform, containerized services utilize vm2 internally to isolate dynamic code. If an attacker can supply a crafted script to the vulnerable CLI utility, the containment boundary is breached, allowing arbitrary execution within the host environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92950"
},
{
"category": "external",
"summary": "RHBZ#2536053",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536053"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92950",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92950"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92950",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92950"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-jxxv-8r27-vm4p",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-jxxv-8r27-vm4p"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/vm2-before-3.11.7-sandbox-escape-via-cli-require",
"url": "https://www.vulncheck.com/advisories/vm2-before-3.11.7-sandbox-escape-via-cli-require"
}
],
"release_date": "2026-09-17T13:46:10.113000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vm2: vm2 before 3.11.7 Sandbox Escape via CLI require"
},
{
"cve": "CVE-2026-92951",
"cwe": {
"id": "CWE-706",
"name": "Use of Incorrectly-Resolved Name or Reference"
},
"discovery_date": "2026-09-17T13:56:21.650652+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536042"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. The external package allowlist improperly validates package names using substring matching rather than exact name boundaries. An attacker capable of running code within the sandbox can exploit this issue by requesting a package name containing an allowlisted substring, allowing them to load unauthorized host packages and execute arbitrary code outside the sandbox.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having an Important impact for Red Hat products because an attacker capable of supplying untrusted code to the sandbox can break out of isolation and achieve code execution on the underlying host system. Applications such as Red Hat Developer Hub and Ansible Automation Platform that bundle the vm2 library to isolate script evaluation are susceptible if custom module allowlists are configured. Successful exploitation allows unauthorized access to host-level Node.js modules and services, bypassing intended sandbox boundaries without requiring elevated privileges.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92951"
},
{
"category": "external",
"summary": "RHBZ#2536042",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536042"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92951",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92951"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92951",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92951"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-c48m-32m9-vx93",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-c48m-32m9-vx93"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/vm2-before-3.11.7-module-allowlist-bypass-via-custom-resolver",
"url": "https://www.vulncheck.com/advisories/vm2-before-3.11.7-module-allowlist-bypass-via-custom-resolver"
}
],
"release_date": "2026-09-17T13:46:10.792000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vm2: vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver"
},
{
"cve": "CVE-2026-92953",
"cwe": {
"id": "CWE-913",
"name": "Improper Control of Dynamically-Managed Code Resources"
},
"discovery_date": "2026-09-17T13:55:28.103242+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536040"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. The sandbox fails to properly isolate host object structures from untrusted code running inside the virtual machine. An attacker can exploit this issue by manipulating object prototype chains to modify shared host prototypes, resulting in prototype pollution (the unauthorized alteration of base object properties). This flaw allows an attacker to compromise the integrity of host-created objects after execution completes, potentially leading to unauthorized data alteration or a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates this vulnerability as an Important severity issue because untrusted JavaScript code executed within the sandbox can escape isolation boundaries and tamper with the host runtime environment. Exploitation allows code running in the sandboxed context to modify shared object prototypes, undermining the integrity and availability of the surrounding Node.js application. While exploitation requires the ability to supply code for evaluation, the resulting blast radius allows complete compromise of the host process without requiring elevated system privileges.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92953"
},
{
"category": "external",
"summary": "RHBZ#2536040",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536040"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92953",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92953"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92953",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92953"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-3vgf-8m4q-q4qr",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-3vgf-8m4q-q4qr"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/vm2-3.11.0-through-3.11.7-prototype-pollution-via-typedarray",
"url": "https://www.vulncheck.com/advisories/vm2-3.11.0-through-3.11.7-prototype-pollution-via-typedarray"
}
],
"release_date": "2026-09-17T13:46:12.146000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vm2: vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray"
},
{
"cve": "CVE-2026-92954",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"discovery_date": "2026-09-17T13:58:48.699803+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536051"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. An attacker capable of running untrusted code within the sandbox can trigger a Denial of Service (DoS) by causing the host application process to terminate. This vulnerability exists because asynchronous operations (Promises) returned from the host environment are not properly marked as handled across the sandbox boundary. By invoking a host function that returns a rejected Promise and ignoring its return value, the unhandled rejection causes the underlying Node.js runtime to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2 3.10.0 through 3.11.5 Denial of Service via Host Promise",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because an untrusted script running inside the sandbox can trigger process termination on the host, causing a complete denial of service. In Red Hat products embedding vm2 to evaluate dynamic user-provided code, such as developer portals and orchestration backends, an attacker can exploit the bridge boundary to crash the application runtime. Although the flaw does not facilitate sandbox escapes, privilege escalation, or unauthorized access to data, the crash disrupts service availability for all concurrent users sharing the host instance.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92954"
},
{
"category": "external",
"summary": "RHBZ#2536051",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536051"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92954",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92954"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92954",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92954"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-gjq8-xm47-88rc",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-gjq8-xm47-88rc"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/vm2-3.10.0-through-3.11.5-denial-of-service-via-host-promise",
"url": "https://www.vulncheck.com/advisories/vm2-3.10.0-through-3.11.5-denial-of-service-via-host-promise"
}
],
"release_date": "2026-09-17T13:46:12.820000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vm2: vm2 3.10.0 through 3.11.5 Denial of Service via Host Promise"
},
{
"cve": "CVE-2026-92956",
"cwe": {
"id": "CWE-693",
"name": "Protection Mechanism Failure"
},
"discovery_date": "2026-09-17T13:57:16.560528+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536045"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. When running untrusted code within a sandbox, improper isolation in WebAssembly streaming functions allows host error objects to leak into the sandbox environment. An attacker capable of running code inside the sandbox can exploit this flaw to escape sandbox containment and achieve arbitrary code execution on the underlying host system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has evaluated this vulnerability as having an Important severity because it enables an attacker with the ability to run code in an isolated sandbox to completely circumvent isolation boundaries and execute arbitrary actions with host application privileges. In Red Hat products incorporating vm2, such as Red Hat Developer Hub and Ansible Automation Platform components, the risk is present when applications evaluate untrusted scripts, though successful exploitation depends on having direct access to execute untrusted code in the sandbox. Furthermore, the blast radius is constrained to the permissions and privileges granted to the underlying container or host service process.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92956"
},
{
"category": "external",
"summary": "RHBZ#2536045",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536045"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92956",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92956"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92956",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92956"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-wjwh-qqvp-g4p4",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-wjwh-qqvp-g4p4"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/vm2-3.10.1-through-3.11.6-sandbox-escape-via-webassembly-compilestreaming",
"url": "https://www.vulncheck.com/advisories/vm2-3.10.1-through-3.11.6-sandbox-escape-via-webassembly-compilestreaming"
}
],
"release_date": "2026-09-17T13:46:14.202000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vm2: vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming"
},
{
"cve": "CVE-2026-92957",
"cwe": {
"id": "CWE-269",
"name": "Improper Privilege Management"
},
"discovery_date": "2026-09-17T13:51:51.269823+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536025"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. Untrusted code running within the sandbox can bypass module restriction policies to achieve arbitrary code execution on the underlying host. Due to improper normalization of module names containing the node: prefix, deny-list rules fail to prevent access to sensitive built-in modules such as child_process. An attacker can exploit this vulnerability to escape the sandbox and execute commands directly on the host system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2 before 3.11.7 Authentication Bypass via node: Prefix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important impact for Red Hat products because an attacker capable of submitting sandboxed scripts can bypass module deny-list restrictions and execute arbitrary commands in the host container environment. While achieving process execution from within a sandbox is a critical security bypass, the rating is kept at Important because exploitation requires authenticated or configured access to execute untrusted code and the blast radius is bounded by the container runtime. Affected components across Red Hat Developer Hub and Red Hat Ansible Automation Platform bundle vm2 for script isolation, leaving backend service environments vulnerable if untrusted input is evaluated.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92957"
},
{
"category": "external",
"summary": "RHBZ#2536025",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536025"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92957",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92957"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92957",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92957"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-8686-vhfx-7r3j",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-8686-vhfx-7r3j"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/vm2-before-3.11.7-authentication-bypass-via-node-prefix",
"url": "https://www.vulncheck.com/advisories/vm2-before-3.11.7-authentication-bypass-via-node-prefix"
}
],
"release_date": "2026-09-17T13:46:14.875000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vm2: vm2 before 3.11.7 Authentication Bypass via node: Prefix"
},
{
"cve": "CVE-2026-92960",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2026-09-17T13:53:02.548737+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536031"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. In configurations allowing built-in modules, vm2 fails to restrict access to the host operating system and Domain Name System (DNS) modules. An attacker who can execute code inside the sandbox can exploit this flaw to hijack the host process DNS resolver, redirecting outbound network queries to an attacker-controlled server. Additionally, this flaw allows the attacker to obtain sensitive host system information, such as process credentials and network topology, or alter process execution priorities.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2 before 3.11.6 Process-wide State Exposure via os and dns",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because untrusted scripts executed within a sandboxed context can alter host process networking configurations and expose system-level identity details. Successful exploitation allows an attacker executing sandboxed code to hijack global name resolution for the entire host process, potentially intercepting outbound network communication without requiring direct operating system command execution. In supported Red Hat offerings such as Red Hat Developer Hub and Ansible Automation Platform, impact is contingent upon services evaluating untrusted code in sandbox environments configured with wildcard built-in module resolution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-92960"
},
{
"category": "external",
"summary": "RHBZ#2536031",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536031"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-92960",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-92960"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92960",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92960"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-m5w8-4gq2-6f8x",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-m5w8-4gq2-6f8x"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/vm2-before-3.11.6-process-wide-state-exposure-via-os-and-dns",
"url": "https://www.vulncheck.com/advisories/vm2-before-3.11.6-process-wide-state-exposure-via-os-and-dns"
}
],
"release_date": "2026-09-17T13:46:16.952000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vm2: vm2 before 3.11.6 Process-wide State Exposure via os and dns"
},
{
"cve": "CVE-2026-93603",
"cwe": {
"id": "CWE-653",
"name": "Improper Isolation or Compartmentalization"
},
"discovery_date": "2026-09-22T15:43:21.076392+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2537857"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. This vulnerability allows an attacker who can execute untrusted script within the sandbox to achieve arbitrary code execution on the underlying host system by escaping sandbox containment. The issue occurs because vm2 fails to properly handle function calls lacking an object receiver, causing the JavaScript runtime to expose the host environment\u0027s global object to the sandboxed code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has rated this vulnerability as having Critical impact because escaping the sandbox boundary allows unauthenticated remote adversaries executing untrusted code to gain full host-level code execution with the permissions of the parent Node.js service. In Red Hat environments such as Developer Hub and Automation Platform, affected backend services utilize vm2 to evaluate dynamic templates or workflow logic, placing containerized hosts at risk of complete compromise. Successful exploitation relies on the hosting application exposing non-strict functions to the isolated environment; services exposing only ECMAScript modules or strict-mode bindings are unaffected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93603"
},
{
"category": "external",
"summary": "RHBZ#2537857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537857"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93603",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93603"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-j89j-5m6r-cr2q",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-j89j-5m6r-cr2q"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/vm2-before-3.12.1-sandbox-escape-rce-via-non-strict-host-function",
"url": "https://www.vulncheck.com/advisories/vm2-before-3.12.1-sandbox-escape-rce-via-non-strict-host-function"
}
],
"release_date": "2026-09-18T13:20:12.955000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Until the fix is applied, do not expose non-strict host functions to the sandbox. Only inject strict-mode or ES-module functions so a missing this cannot resolve to the host global.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "vm2: vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function"
},
{
"cve": "CVE-2026-93604",
"cwe": {
"id": "CWE-1100",
"name": "Insufficient Isolation of System-Dependent Functions"
},
"discovery_date": "2026-09-22T19:42:35.578811+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2538616"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. Untrusted guest code can exploit this vulnerability when the `crypto` builtin is explicitly allowlisted for a NodeVM (Node.js Virtual Machine). By calling the `crypto.setFips()` function, an attacker can modify the FIPS (Federal Information Processing Standards) mode of the entire host process. This allows guest code to bypass the NodeVM isolation boundary, leading to a sandbox escape and potentially impacting the integrity of the host system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2: Sandbox escape via `crypto.setFips()` function",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A sandbox escape vulnerability was found in vm2, a Node.js library for running untrusted code in isolated sandboxes. In versions through 3.12.0, vm2 exposes Node.js\u0027s crypto.setFips() function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM (by setting require.builtin: [\u0027crypto\u0027]). The builtin sanitizer in lib/builtin.js replaces crypto.setEngine() but leaves crypto.setFips() callable, and the readonly wrapper used to expose the host module does not localize side effects of forwarded host functions. As a result, guest code can call crypto.setFips() to change the FIPS mode of the entire host process, crossing the NodeVM isolation boundary.\n\nThe modified FIPS mode is subsequently observed by trusted host code, violating vm2\u0027s fundamental security guarantee of isolating untrusted guest code from the host process. This issue affects Red Hat Developer Hub and Ansible Portal, which use vm2 for sandboxed code execution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93604"
},
{
"category": "external",
"summary": "RHBZ#2538616",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538616"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93604",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93604"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93604",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93604"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-x3v6-43hc-82mc",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-x3v6-43hc-82mc"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/vm2-3.11.8-sandbox-escape-via-crypto-setfips",
"url": "https://www.vulncheck.com/advisories/vm2-3.11.8-sandbox-escape-via-crypto-setfips"
}
],
"release_date": "2026-09-18T13:20:13.637000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "This issue is fixed in vm2 version 3.12.1. Red Hat will provide updated versions of Developer Hub and Ansible Portal that include the fixed library version.\n \nUntil updates are available, administrators can reduce the risk of sandbox escape attacks by implementing the following mitigations:\n \n1. Review vm2 sandbox configurations to determine if the \u0027crypto\u0027 builtin is explicitly allowlisted for untrusted guest code (require.builtin: [\u0027crypto\u0027]). If crypto access is not required for guest code functionality, remove it from the allowlist.\n \n2. Restrict the sources from which untrusted code is accepted. Only allow code execution from authenticated, trusted users or verified sources. Implement code review processes for any scripts or plugins before they are executed in vm2 sandboxes.\n \n3. Monitor for unexpected changes to the Node.js process FIPS mode. Log calls to crypto.getFips() before and after guest code execution to detect unauthorized FIPS mode modifications. \n \n4. In FIPS-required environments, consider running vm2 sandboxes in separate isolated processes rather than in the same process as critical application components. Process-level isolation provides an additional security boundary beyond vm2\u0027s VM isolation.\n \n5. Implement additional access controls and audit logging for any systems that accept and execute user-provided code, scripts, or plugins.\n \n6. Upgrade to vm2 3.12.1 or later as soon as updated packages are available from Red Hat.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vm2: vm2: Sandbox escape via `crypto.setFips()` function"
},
{
"cve": "CVE-2026-93605",
"cwe": {
"id": "CWE-184",
"name": "Incomplete List of Disallowed Inputs"
},
"discovery_date": "2026-09-22T18:38:04.797953+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2538474"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. The sandbox environment fails to restrict access to the child_process module, which handles system command execution. In environments configured to allow built-in modules, an attacker capable of running untrusted code within the sandbox can load this module to break containment. This can result in arbitrary code execution on the underlying host system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2 NodeVM before 3.12.1 Remote Code Execution via child_process",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Critical because an unauthenticated or untrusted actor able to evaluate script logic within the sandbox can escape isolation without privileges and execute arbitrary commands on the host system. This escape results in complete loss of confidentiality, integrity, and availability for the hosting environment. In Red Hat environments, including Red Hat Developer Hub and Ansible Automation Platform, backend services utilizing the vulnerable library for dynamic code evaluation risk full host container compromise.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93605"
},
{
"category": "external",
"summary": "RHBZ#2538474",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538474"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93605"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-pq68-rvw4-xp4r",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-pq68-rvw4-xp4r"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/vm2-nodevm-before-3.12.1-remote-code-execution-via-child-process",
"url": "https://www.vulncheck.com/advisories/vm2-nodevm-before-3.12.1-remote-code-execution-via-child-process"
}
],
"release_date": "2026-09-18T13:20:14.332000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Until the fix is applied, do not configure NodeVM with require.builtin set to [\u0027*\u0027], a star-minus subtract list, or an explicit child_process allow. Use a tight builtin allowlist that excludes child_process.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "vm2: vm2 NodeVM before 3.12.1 Remote Code Execution via child_process"
},
{
"cve": "CVE-2026-93606",
"cwe": {
"id": "CWE-653",
"name": "Improper Isolation or Compartmentalization"
},
"discovery_date": "2026-09-22T18:30:04.366087+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2538416"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vm2. An attacker running untrusted code within the sandbox can bypass isolation controls to achieve arbitrary code execution on the host system. This issue is caused by improper sanitization of host Promise objects, which allows sandboxed scripts to manipulate Promise constructor properties and obtain direct references to sensitive host-level objects. Consequently, an attacker can break out of the restricted sandbox environment and fully compromise the host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vm2: vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated with Critical severity because it permits an attacker executing code within a sandboxed environment to bypass isolation boundaries and achieve full arbitrary code execution within the host process without requiring privileges or user interaction. In Red Hat environments where services evaluate user-supplied JavaScript, an untrusted actor can escape sandbox containment and gain control over the underlying application process. The total breakdown of containment controls and the potential for complete host-level compromise justify the Critical impact rating.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93606"
},
{
"category": "external",
"summary": "RHBZ#2538416",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538416"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93606",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93606"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93606",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93606"
},
{
"category": "external",
"summary": "https://github.com/patriksimek/vm2/security/advisories/GHSA-6454-5x88-m6jw",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-6454-5x88-m6jw"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/vm2-before-3.12.1-sandbox-escape-via-promise-symbol-species",
"url": "https://www.vulncheck.com/advisories/vm2-before-3.12.1-sandbox-escape-via-promise-symbol-species"
}
],
"release_date": "2026-09-18T13:20:15.036000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
},
{
"category": "workaround",
"details": "Until the fix is applied, do not expose host functions that return host-realm Promise objects to VM/NodeVM. Return only serialized primitives, or keep host work fully outside the sandbox.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "vm2: vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species"
},
{
"cve": "CVE-2026-101916",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-09-28T20:33:03.139268+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2542678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in grpc-js. In configurations where client certificates are optional, the authentication context lookup fails to distinguish between authorized and unauthorized peer certificates. A remote attacker can exploit this vulnerability by presenting an untrusted certificate, allowing them to bypass authentication mechanisms and access protected services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "grpc-js: grpc-js: Authentication bypass via improper peer certificate validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Important because an unauthenticated remote client could bypass access control mechanisms when exposed gRPC services evaluate optional peer certificates. The issue manifests when services permit client certificates optionally and downstream authorization logic or role-based access control relies on the resulting peer authentication context. In environments where client certificates are strictly mandated or completely disabled at the transport layer, the condition cannot be triggered. Although successful exploitation requires specific configuration prerequisites, it allows complete circumvention of identity verification across exposed network services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-101916"
},
{
"category": "external",
"summary": "RHBZ#2542678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-101916",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-101916"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-101916",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101916"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee",
"url": "https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c",
"url": "https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5",
"url": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j",
"url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j"
}
],
"release_date": "2026-09-28T20:01:53.640000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-12T05:44:41+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:80603"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.1:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:f92d478c1fad9df93d573b3a4d4cc5904f57f33d65a308472265c8bfeb057f59_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "grpc-js: grpc-js: Authentication bypass via improper peer certificate validation"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.