{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"mta/mta-rhel9-operator","product":"Migration Toolkit for Applications 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"migration-toolkit-virtualization/mtv-rhel9-operator","product":"Migration Toolkit for Virtualization","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift-service-mesh/kiali-rhel9-operator","product":"OpenShift Service Mesh 3","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhacm2/volsync-operator-bundle","product":"Red Hat Advanced Cluster Management for Kubernetes 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhacm2/volsync-rhel9","product":"Red Hat Advanced Cluster Management for Kubernetes 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-24/de-minimal-rhel8","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-24/de-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-24/ee-minimal-rhel8","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-24/ee-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-24/hub-rhel8","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-24/lightspeed-rhel8","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-25/ansible-dev-tools-rhel8","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-25/de-minimal-rhel8","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-25/de-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-25/eda-controller-rhel8","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-25/ee-minimal-rhel8","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-25/ee-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-25/hub-rhel8","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-25/lightspeed-rhel8","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/ansible-dev-tools-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/controller-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/de-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/de-supported-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/eda-controller-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/eda-controller-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/ee-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/ee-supported-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/gateway-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/hub-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/hub-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/lightspeed-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/lightspeed-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/platform-resource-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/platform-resource-runner-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-27/aap-cloud-billing-operator-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-27/ansible-devspaces-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-27/ansible-dev-tools-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-27/controller-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-27/de-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-27/de-supported-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-27/eda-controller-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-27/eda-controller-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-27/ee-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-27/ee-supported-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-27/gateway-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-27/hub-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-27/hub-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-27/lightspeed-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-27/lightspeed-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-27/metrics-service-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-27/platform-resource-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-27/platform-resource-runner-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-tech-preview/ansible-devspaces-rhel9","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-tech-preview/metrics-service-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-core","product":"Red Hat Ansible Automation Platform 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform/ee-minimal-rhel8","product":"Red Hat Ansible Automation Platform Ansible Core 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform/ee-minimal-rhel9","product":"Red Hat Ansible Automation Platform Ansible Core 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-tech-preview/ee-minimal-rhel8","product":"Red Hat Ansible Automation Platform Ansible Core 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-tech-preview/ee-minimal-rhel9","product":"Red Hat Ansible Automation Platform Ansible Core 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhcertification/redhat-certification-system-ai","product":"Red Hat Certification Program for Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"discovery/discovery-server-rhel9","product":"Red Hat Discovery 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-core","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-core","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-core","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4/ose-ansible-rhel9-operator","product":"Red Hat OpenShift Container Platform 4","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift5/ose-ansible-rhel9-operator","product":"Red Hat OpenShift Container Platform 5","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openstack-ansible-core","product":"Red Hat OpenStack Platform 17.1","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhoso-operators/ee-openstack-ansible-ee-rhel9","product":"Red Hat OpenStack Platform 18.0","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-core","product":"Red Hat Satellite 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhui5/installer-rhel9","product":"Red Hat Update Infrastructure 5","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhui5/installer-tp-rhel9","product":"Red Hat Update Infrastructure 5","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhui5/rhua-rhel9","product":"Red Hat Update Infrastructure 5","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhui5/rhua-tp-rhel9","product":"Red Hat Update Infrastructure 5","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform/bootc-automation-portal-rhel9","product":"Self-service automation portal 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-89091","cwes":["CWE-59"],"description":"A flaw was found in ansible-core. When installing a collection with\n`ansible-galaxy collection install`, the archive extractor validates member\npaths using lexical path normalisation (os.path.abspath) instead of resolving\nsymbolic links (os.path.realpath), and it performs no containment check on\nsymlink-typed directory members before creating them. A crafted collection\ntarball can chain symlink directory entries so that a subsequent file member is\nwritten outside the intended destination directory. This allows an attacker who\ncan get a victim to install a malicious collection to overwrite arbitrary files\nwith the privileges of the user running ansible-galaxy, leading to code\nexecution on the control node. This is a bypass of the fix for CVE-2020-10691.","epss":{"date":"2026-11-02","percentile":0.41407,"score":0.0048},"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},{"score":8.8,"severity":"high","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793661441370,"publishedAt":1791496170953,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-89091"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531646"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2026-89091"},{"source":"secalert@redhat.com","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531646"}],"remediation":[],"revision":"cc7af8ab0b48c9690594874ab41066f357e16557362fe7397f580a09dbbacc8d","sources":[{"modifiedAt":1793657573879,"name":"CNA: redhat","retrievedAt":1793660929289,"url":"https://www.cve.org/CVERecord?id=CVE-2026-89091"},{"modifiedAt":1793661441370,"name":"NVD","retrievedAt":1793665162909,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89091"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793660930362,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89091"}],"ssvc":{"assessedAt":1791558000715,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution","updatedAt":1793665162909}