CVE-2026-71364 Red Hat CVE debrief

Who should care

Defenders responsible for AWX installations and administrators of Red Hat Ansible Automation Platform should assess exposure and prioritize updates. Security teams and vulnerability management teams should also be aware of the potential impact and take necessary actions to prevent exploitation. Additionally, operators and platform administrators may need to review and update their systems to ensure security.

Why it matters

Defenders should care about CVE-2026-71364 because it allows for potential arbitrary file writes and remote code execution in AWX installations, particularly in Red Hat Ansible Automation Platform. The vulnerability requires verification and updates to prevent exploitation.

• Potential arbitrary file writes on execution nodes
• Possible remote code execution through mechanisms like cron files or SSH authorized keys
• Need for verification of AWX installations and updates
• Potential for lateral movement and further exploitation

Technical summary

The project_archive action plugin in AWX does not properly handle archive extraction, allowing for path traversal attacks. This vulnerability can lead to arbitrary file writes and potential remote code execution. The plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory traversal sequences. A malicious archive containing members with path traversal components can write files to arbitrary locations on the execution node's filesystem outside the intended project directory.

Defensive priority

Defenders should prioritize verifying and updating AWX installations to prevent potential arbitrary file writes.

Recommended defensive actions

• Verify AWX installations for potential vulnerabilities
• Update AWX to the latest version
• Restrict access to archive extraction functionality
• Monitor for suspicious activity
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and source item provide details on the vulnerability, but do not specify versions or confirm exploitation. Defenders should verify AWX installations and assess exposure based on the provided information. Evidence from the CVE Program and NVD detail page supports the vulnerability's existence and potential impact. However, additional verification tasks are necessary to ensure the security of AWX installations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.