Bug 2486729 (CVE-2026-52902)

Summary: CVE-2026-52902 awxkit: path traversal via YAML !include directive
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: adudiak, dschmidt, dymurray, erezende, ibolton, jlanda, jmatthew, jmontleo, kshier, ljawale, luizcosta, nweather, pgaikwad, rbobbitt, rjohnson, simaishi, slucidi, smcdonal, sseago, stcannon, teagle, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.format yaml import". This is a client-side vulnerability requiring user interaction.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-09 07:19:23 UTC 
A path traversal vulnerability was found in awxkit's YAML !include directive. The extractFile() function in awxkit/yaml_file.py constructs file paths using os.path.join() with unsanitized user-controlled input from !include tags, without any path containment check. An attacker who can convince a user to import a malicious YAML file via "awx --conf.format yaml import" can read arbitrary YAML-formatted files from the user's filesystem. The included file contents are populated into AWX resource fields and become accessible via the AWX API/UI.

Upstream: https://github.com/ansible/awx/tree/devel/awxkit
Affected file: awxkit/awxkit/yaml_file.py

Limited surface attack factors:
 - Client-side only (awxkit is a CLI tool)
 - Requires user to download and execute a malicious YAML file
 - Only YAML-formatted files can be read (not plaintext/binary)
 - JSON is the default import format; only --conf.format yaml affected
 - API field validations constrain exfiltration
Comment 7 errata-xmlrpc 2026-08-24 16:24:31 UTC 
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.7 for RHEL 10
  Red Hat Ansible Automation Platform 2.7 for RHEL 9

Via RHSA-2026:59137 https://access.redhat.com/errata/RHSA-2026:59137
Comment 8 errata-xmlrpc 2026-08-24 16:25:48 UTC 
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.5 for RHEL 9
  Red Hat Ansible Automation Platform 2.5 for RHEL 8

Via RHSA-2026:59135 https://access.redhat.com/errata/RHSA-2026:59135
Comment 9 errata-xmlrpc 2026-08-24 16:27:25 UTC 
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.6 for RHEL 9
  Red Hat Ansible Automation Platform 2.6 for RHEL 10

Via RHSA-2026:59136 https://access.redhat.com/errata/RHSA-2026:59136