{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-89091", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-09-10T20:17:42.169Z", "datePublished": "2026-10-08T21:49:30.953Z", "dateUpdated": "2026-10-09T15:13:02.773Z" }, "containers": { "cna": { "title": "Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution", "metrics": [ { "other": { "content": { "value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "format": "CVSS" } ], "descriptions": [ { "lang": "en", "value": "A flaw was found in ansible-core. When installing a collection with\n`ansible-galaxy collection install`, the archive extractor validates member\npaths using lexical path normalisation (os.path.abspath) instead of resolving\nsymbolic links (os.path.realpath), and it performs no containment check on\nsymlink-typed directory members before creating them. A crafted collection\ntarball can chain symlink directory entries so that a subsequent file member is\nwritten outside the intended destination directory. This allows an attacker who\ncan get a victim to install a malicious collection to overwrite arbitrary files\nwith the privileges of the user running ansible-galaxy, leading to code\nexecution on the control node. This is a bypass of the fix for CVE-2020-10691." } ], "affected": [ { "vendor": "Red Hat", "product": "Migration Toolkit for Applications 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "mta/mta-rhel9-operator", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:migration_toolkit_applications:8" ] }, { "vendor": "Red Hat", "product": "Migration Toolkit for Virtualization", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "migration-toolkit-virtualization/mtv-rhel9-operator", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:migration_toolkit_virtualization:2" ] }, { "vendor": "Red Hat", "product": "OpenShift Service Mesh 3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift-service-mesh/kiali-rhel9-operator", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:service_mesh:3" ] }, { "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhacm2/volsync-operator-bundle", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:acm:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhacm2/volsync-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:acm:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-24/de-minimal-rhel8", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-24/de-minimal-rhel9", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-24/ee-minimal-rhel8", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-24/ee-minimal-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-24/hub-rhel8", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-24/lightspeed-rhel8", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-25/ansible-dev-tools-rhel8", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-25/de-minimal-rhel8", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-25/de-minimal-rhel9", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-25/eda-controller-rhel8", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-25/ee-minimal-rhel8", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-25/ee-minimal-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-25/hub-rhel8", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-25/lightspeed-rhel8", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/ansible-dev-tools-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/controller-rhel9-operator", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/de-minimal-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/de-supported-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/eda-controller-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/eda-controller-rhel9-operator", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/ee-minimal-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/ee-supported-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/gateway-rhel9-operator", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/hub-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/hub-rhel9-operator", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/lightspeed-rhel9", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/lightspeed-rhel9-operator", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/platform-resource-rhel9-operator", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/platform-resource-runner-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-27/aap-cloud-billing-operator-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-27/ansible-devspaces-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-27/ansible-dev-tools-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-27/controller-rhel9-operator", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-27/de-minimal-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-27/de-supported-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-27/eda-controller-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-27/eda-controller-rhel9-operator", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-27/ee-minimal-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-27/ee-supported-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-27/gateway-rhel9-operator", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-27/hub-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-27/hub-rhel9-operator", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-27/lightspeed-rhel9", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-27/lightspeed-rhel9-operator", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-27/metrics-service-rhel9-operator", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-27/platform-resource-rhel9-operator", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-27/platform-resource-runner-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-tech-preview/ansible-devspaces-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-tech-preview/metrics-service-rhel9-operator", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-core", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform Ansible Core 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform/ee-minimal-rhel8", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_core:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform Ansible Core 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform/ee-minimal-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_core:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform Ansible Core 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-tech-preview/ee-minimal-rhel8", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_core:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform Ansible Core 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-tech-preview/ee-minimal-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_core:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Certification Program for Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhcertification/redhat-certification-system-ai", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:certifications:9" ] }, { "vendor": "Red Hat", "product": "Red Hat Discovery 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "discovery/discovery-server-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:discovery:2::el9" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-core", "defaultStatus": "affected", "cpes": [ "cpe:/o:redhat:enterprise_linux:10" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-core", "defaultStatus": "affected", "cpes": [ "cpe:/o:redhat:enterprise_linux:8" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-core", "defaultStatus": "affected", "cpes": [ "cpe:/o:redhat:enterprise_linux:9" ] }, { "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift4/ose-ansible-rhel9-operator", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:openshift:4" ] }, { "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 17.1", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openstack-ansible-core", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:openstack:17.1" ] }, { "vendor": "Red Hat", "product": "Red Hat OpenStack Platform 18.0", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoso-operators/ee-openstack-ansible-ee-rhel9", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:openstack:18.0" ] }, { "vendor": "Red Hat", "product": "Red Hat Satellite 6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-core", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:satellite:6" ] }, { "vendor": "Red Hat", "product": "Red Hat Update Infrastructure 5", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhui5/installer-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:rhui:5::el9" ] }, { "vendor": "Red Hat", "product": "Red Hat Update Infrastructure 5", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhui5/installer-tp-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:rhui:5::el9" ] }, { "vendor": "Red Hat", "product": "Red Hat Update Infrastructure 5", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhui5/rhua-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:rhui:5::el9" ] }, { "vendor": "Red Hat", "product": "Red Hat Update Infrastructure 5", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhui5/rhua-tp-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:rhui:5::el9" ] }, { "vendor": "Red Hat", "product": "Self-service automation portal 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform/bootc-automation-portal-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ansible_portal:2" ] } ], "references": [ { "url": "https://access.redhat.com/security/cve/CVE-2026-89091", "tags": [ "vdb-entry", "x_refsource_REDHAT" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531646", "name": "RHBZ#2531646", "tags": [ "issue-tracking", "x_refsource_REDHAT" ] } ], "datePublic": "2026-09-25T00:00:00.000Z", "problemTypes": [ { "descriptions": [ { "cweId": "CWE-59", "description": "Improper Link Resolution Before File Access ('Link Following')", "lang": "en", "type": "CWE" } ] } ], "x_redhatCweChain": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "timeline": [ { "lang": "en", "time": "2026-09-10T20:17:34.126Z", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2026-09-25T00:00:00.000Z", "value": "Made public." } ], "credits": [ { "lang": "en", "value": "Red Hat would like to thank Parameter Autonomous Pentesting Agent (parameter.ai) for reporting this issue." } ], "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-08T21:49:30.953Z" }, "x_generator": { "engine": "cvelib 1.8.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-10-09T15:00:00.715697Z", "id": "CVE-2026-89091", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-09T15:13:02.773Z" } } ] } }