CVE-2026-52902: AWX awxkit Path Traversal Vulnerability

CVE-2026-52902 Overview

CVE-2026-52902 is a path traversal vulnerability [CWE-22] in awxkit, the command-line interface (CLI) tool for Ansible AWX. The flaw exists in the handling of the YAML !include directive, which fails to sanitize file paths supplied within YAML documents. An attacker can craft a malicious YAML file that, when imported by a user with awx --conf.format yaml import, reads arbitrary YAML-formatted files from the local filesystem. Exploitation requires user interaction and local access, making this a client-side issue rather than a remotely exploitable flaw.

Critical Impact
A crafted YAML configuration file can disclose the contents of arbitrary YAML-parseable files on the victim's filesystem when imported through the awxkit CLI.

Affected Products

awxkit CLI tool for Ansible AWX
Workflows that invoke awx --conf.format yaml import against untrusted YAML input
Downstream Red Hat distributions tracking the issue under Red Hat CVE Advisory

Discovery Timeline

2026-06-09 - CVE-2026-52902 published to the National Vulnerability Database (NVD)
2026-06-09 - Last updated in the NVD database

Technical Details for CVE-2026-52902

Vulnerability Analysis

The vulnerability resides in how awxkit parses YAML documents passed to its import subcommand. YAML supports an !include tag that loads the contents of a referenced file into the parsed document tree. In awxkit, the handler for this directive accepts the supplied path without normalization or restriction. As a result, an attacker can reference absolute paths or paths containing ../ sequences to traverse outside the expected configuration directory.

When a victim runs awx --conf.format yaml import against the malicious YAML file, the included contents are read by the parser and folded into the import operation. Any file that is valid YAML, or that the parser will treat as YAML, can be disclosed. Because the attack vector is local and requires user interaction with attacker-supplied content, this is classified as a client-side issue.

Root Cause

The root cause is missing input validation on the path argument passed to the YAML !include directive. The implementation does not enforce a base directory, reject absolute paths, or strip parent-directory references. This maps directly to CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

An attacker delivers a malicious YAML file through a phishing message, a shared repository, or documentation that instructs the user to import it with awxkit. The YAML contains a directive such as !include /path/to/sensitive.yml. When the victim runs the import command, awxkit resolves the path, reads the referenced file, and incorporates its contents into the operation. The disclosure is limited to files that the parser can ingest as YAML, which still includes a broad range of configuration material such as Ansible inventories, vault metadata files, and other YAML credentials stores within the user's home directory.

No proof-of-concept exploit code is published in the referenced advisories. Refer to the Red Hat Bug Report #2486729 for additional technical context.

Detection Methods for CVE-2026-52902

Indicators of Compromise

YAML files containing !include directives that reference absolute paths or paths with ../ sequences outside the working directory.
Recent invocations of awx --conf.format yaml import against files received from untrusted sources such as email attachments or external repositories.
Unexpected reads of sensitive YAML files (for example ~/.ansible/, ~/.config/, or vault metadata) by the awxkit process.

Detection Strategies

Inspect YAML files prior to import for the presence of !include tags and validate that referenced paths remain within an approved directory.
Hook process auditing (auditd, EDR file-access telemetry) on the awx and awxkit binaries to record file-open events during import operations.
Correlate awxkit execution with reads of files outside the user's current working directory to surface traversal attempts.

Monitoring Recommendations

Enable shell history and command-line logging for administrators who use awxkit, and review imports of YAML files originating outside trusted source control.
Forward host process and file-access events to a centralized data lake to enable retroactive hunting for the !include pattern.
Alert on awxkit reading files from sensitive directories such as /etc/, ~/.ssh/, or vault storage locations during an import workflow.

How to Mitigate CVE-2026-52902

Immediate Actions Required

Do not run awx --conf.format yaml import against YAML files received from untrusted sources until a patched awxkit release is installed.
Inventory hosts where awxkit is installed and identify users who routinely perform YAML imports.
Review recent imports for malicious !include directives and rotate any credentials that may have been disclosed.

Patch Information

At time of publication, vendor-fixed package versions are tracked through the Red Hat CVE Advisory and Red Hat Bug Report #2486729. Apply the updated awxkit package from your distribution once it becomes available and verify the YAML loader sanitizes paths supplied to !include.

Workarounds

Validate YAML files manually before import, removing any !include directives that reference paths outside the intended configuration directory.
Run awxkit import operations inside a restricted sandbox or container with read access limited to the configuration directory only.
Restrict filesystem permissions so the user account running awxkit cannot read sensitive YAML resources such as private inventories or vault metadata.

bash

# Configuration example: scan a YAML file for !include directives before import
grep -nE '!include[[:space:]]+' suspect.yml && echo 'Review required: !include directive present'