https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 06:11:09 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-377313 EUVD-2026-377313 https://cve.radiocsirt.org/vuln/euvd-2026-377313 https://cve.radiocsirt.org/vuln/fkie_cve-2026-76648 <p>CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF&#39;s get_object() performs no object-level RBAC. The get() handler (lines 988–991) explicitly guards with request.user.can_access(obj._class_, &#39;read&#39;, obj) — but post() (lines 1001–1010) does not. POST only checks:</p> <p>can_access(model, &#39;add&#39;, create_kwargs_check)</p> <p>can_access(model, &#39;copy_related&#39;, obj)</p> <p>For JobTemplate, can_add (awx/awx/main/access.py:1465–1520) gates on</p> <p>inventory.use_role + project.use_role + execution_environment.read_role — resource-level roles that do not imply read on the source JT — and can_copy_related (1522–1534) checks only credentials.use_role. None of these imply the caller can read the source JT.</p> <p>CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF&#39;s get_object() performs no object-level RBAC. The get() handler (lines 988–991) explicitly guards with request.user.can_access(obj._class_, &#39;read&#39;, obj) — but post() (lines 1001–1010) does not. POST only checks:</p> <p>can_access(model, &#39;add&#39;, create_kwargs_check)</p> <p>can_access(model, &#39;copy_related&#39;, obj)</p> <p>For JobTemplate, can_add (awx/awx/main/access.py:1465–1520) gates on</p> <p>inventory.use_role + project.use_role + execution_environment.read_role — resource-level roles that do not imply read on the source JT — and can_copy_related (1522–1534) checks only credentials.use_role. None of these imply the caller can read the source JT.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-76648 https://cve.radiocsirt.org/vuln/ghsa-26cj-h793-xx7v <p>CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF&#39;s get_object() performs no object-level RBAC. The get() handler (lines 988–991) explicitly guards with request.user.can_access(obj._class_, &#39;read&#39;, obj) — but post() (lines 1001–1010) does not. POST only checks:</p> <p>can_access(model, &#39;add&#39;, create_kwargs_check)</p> <p>can_access(model, &#39;copy_related&#39;, obj)</p> <p>For JobTemplate, can_add (awx/awx/main/access.py:1465–1520) gates on</p> <p>inventory.use_role + project.use_role + execution_environment.read_role — resource-level roles that do not imply read on the source JT — and can_copy_related (1522–1534) checks only credentials.use_role. None of these imply the caller can read the source JT.</p> <p>CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF&#39;s get_object() performs no object-level RBAC. The get() handler (lines 988–991) explicitly guards with request.user.can_access(obj._class_, &#39;read&#39;, obj) — but post() (lines 1001–1010) does not. POST only checks:</p> <p>can_access(model, &#39;add&#39;, create_kwargs_check)</p> <p>can_access(model, &#39;copy_related&#39;, obj)</p> <p>For JobTemplate, can_add (awx/awx/main/access.py:1465–1520) gates on</p> <p>inventory.use_role + project.use_role + execution_environment.read_role — resource-level roles that do not imply read on the source JT — and can_copy_related (1522–1534) checks only credentials.use_role. None of these imply the caller can read the source JT.</p> https://cve.radiocsirt.org/vuln/ghsa-26cj-h793-xx7v https://cve.radiocsirt.org/vuln/rhsa-2026:71177 <p>ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration. sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing sqlparse: sqlparse: Denial of Service via inefficient SQL parsing automation-controller: automation-controller-container: automation-controller: Named-URL 404 body oracle enables cross-tenant resource name enumeration automation-controller: automation-controller-container: automation-controller: JobJobEventsChildrenSummary RBAC bypass exposes cross-tenant job event tree structure automation-controller: automation-controller-container: automation-controller: Any authenticated user reads Red Hat subscription/license details via /config/ automation-controller: automation-controller-container: automation-controller: Verbose internal exception disclosure via HostList bare-Exception handler automation-controller: automation-controller-container: automation-controller: CUSTOM_VENV_PATH setting provides filesystem path-existence oracle on co…</p> <p>ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration. sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing sqlparse: sqlparse: Denial of Service via inefficient SQL parsing automation-controller: automation-controller-container: automation-controller: Named-URL 404 body oracle enables cross-tenant resource name enumeration automation-controller: automation-controller-container: automation-controller: JobJobEventsChildrenSummary RBAC bypass exposes cross-tenant job event tree structure automation-controller: automation-controller-container: automation-controller: Any authenticated user reads Red Hat subscription/license details via /config/ automation-controller: automation-controller-container: automation-controller: Verbose internal exception disclosure via HostList bare-Exception handler automation-controller: automation-controller-container: automation-controller: CUSTOM_VENV_PATH setting provides filesystem path-existence oracle on co…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:71177 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3555 <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen und einen Denial-of-Service-Zustand herbeizuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen und einen Denial-of-Service-Zustand herbeizuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3555