Security advisories
Every published vulnerability, its severity and its fix
Published advisories
Read from the Security tab of the repository at every build of this site:
| Advisory | Severity | Weakness | Affected | Fixed in | Published |
|---|---|---|---|---|---|
| Authentication bypass via hard-coded default JWT signing secret GHSA-g27f-cjvv-42rf CVE-2026-73969 | Critical CVSS 9.8 | CWE-287 CWE-798 CWE-1188 | <= 6.2.0 | 6.2.1 | 2026-06-26 |
| OS command injection in repository git operations GHSA-56pr-p4x6-mwm6 CVE-2026-73968 | High CVSS 7.2 | CWE-78 | <= 6.2.0 | 6.2.1 | 2026-06-25 |
| Stored cross-site scripting (job output and form fields) GHSA-wcmj-wqvw-6c88 CVE-2026-73967 | High CVSS 8.7 | CWE-79 CWE-922 CWE-1021 | <= 6.2.0 | 6.2.1 | 2026-06-25 |
Each advisory on GitHub gives the details: the impact, the conditions, the CVSS vector and the fix.
What this means for your version
An advisory names the versions it affects and the first version that is fixed. The fix ships in the supported releases, 7.x and 6.5.x, and older releases are not patched: upgrading is the fix.
Compare the version of an instance (About in the help menu, or GET /api/v2/version) with Affected.
Being told of new advisories
GitHub notifies the watchers of the repository when an advisory is published:
- On github.com/ansibleforms/ansibleforms, choose Watch > Custom > Security alerts.
- The changelog lists every security fix under the release that ships it.