CVE-2026-21226

A flaw was found in the azure-core shared client library for Python. Untrusted data is deserialized, which may allow an authorized attacker to execute arbitrary code over the network.

azure-core 1.30.0 is bundled in the Ansible Automation Platform 2.6 controller image, observed in the awx venv. azure-core is a bundled PyPI dependency pulled in by the Azure Ansible content (azure.azcollection) and other Azure SDK clients across several AAP execution environments; but it is not Red Hat source code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No code-level mitigation is provided by Red Hat. Exploitation requires an authorized actor to supply crafted serialized data to an Azure deserialization code path. Until an execution environment shipping azure-core 1.38.0 or later is available, limit which users can create and run Azure-related automation (azure.azcollection jobs), restrict network access to the controller and execution environments to trusted operators, and remove the Azure collections/ azure-core from environments that do not use Azure automation.