CVE-2026-79699 Path traversal in Red Hat Ansible Automation Platform 2
Attackers can replace extraction destination directories with arbitrary files via malicious tar whiteout headers in containers/storage, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-79699?
CVE-2026-79699 is a medium-severity path traversal vulnerability in Red Hat Ansible Automation Platform 2, published on 15 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
Weakness: CWE-59
Which versions are affected by CVE-2026-79699?
How do I fix CVE-2026-79699?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-79699 being exploited?
There is no known exploitation of CVE-2026-79699 in the wild and no public exploit code.
Sources
Also known as AZL-103062, AZL-103071, AZL-103089, AZL-103140, AZL-103227, AZL-103269 and 4 more.