CVE-2026-52902: awxkit has a path traversal vulnerability

June 9, 2026 (updated July 31, 2026)

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using “awx –conf.format yaml import”. This is a client-side vulnerability requiring user interaction.

References

access.redhat.com/security/cve/CVE-2026-52902
bugzilla.redhat.com/show_bug.cgi?id=2486729
github.com/advisories/GHSA-g29c-rgq6-gxgj
nvd.nist.gov/vuln/detail/CVE-2026-52902

Code Behaviors & Features

Detect and mitigate CVE-2026-52902 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →