Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:13512 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):
    * automation-controller: Account hijacking and unauthorized access via unverified email linking     (CVE-2026-6266)
    * automation-controller: PyJWT accepts unknown `crit` header extensions (RFC 7515 4.1.11 MUST violation)     (CVE-2026-32597)
    * automation-controller: denial of service via malformed HTML-like sequences (CVE-2025-69534)
    * automation-controller: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves     (CVE-2026-26007)
    * automation-gateway: Account hijacking and unauthorized access via unverified email linking     (CVE-2026-6266)
    * automation-gateway: Rollup: Remote Code Execution via Path Traversal Vulnerability (CVE-2026-27606)
    * automation-gateway: SVGO: Denial of Service via XML entity expansion (CVE-2026-29074)
    * automation-gateway: ReDoS via $data reference (CVE-2025-69873)
    * automation-gateway-proxy: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
    * python3.12-django-ansible-base: Account hijacking and unauthorized access via unverified email linking     (CVE-2026-6266)
    * python3.12-markdown: denial of service via malformed HTML-like sequences (CVE-2025-69534)
    * python3.12-jwcrypto: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373)
    * python3.12-pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)
    * python3.12-pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID     (CVE-2026-23490)
    * python3.12-pyOpenSSL: DTLS cookie callback buffer overflow (CVE-2026-27459)
    * receptor: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    For details about this release, refer to the release notes listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:13508 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):
    * automation-controller: Account hijacking and unauthorized access via unverified email linking     (CVE-2026-6266)
    * automation-controller: DTLS cookie callback buffer overflow (CVE-2026-27459)
    * automation-controller: PyJWT accepts unknown `crit` header extensions (RFC 7515 4.1.11 MUST violation)     (CVE-2026-32597)
    * automation-controller: denial of service via malformed HTML-like sequences (CVE-2025-69534)
    * automation-gateway: Account hijacking and unauthorized access via unverified email linking     (CVE-2026-6266)
    * automation-gateway-proxy: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
    * automation-platform-ui: Rollup: Remote Code Execution via Path Traversal Vulnerability (CVE-2026-27606)
    * automation-platform-ui: minimatch: Denial of Service via specially crafted glob patterns     (CVE-2026-26996)
    * python3.12-django-ansible-base: Account hijacking and unauthorized access via unverified email linking     (CVE-2026-6266)
    * python3.12-markdown: denial of service via malformed HTML-like sequences (CVE-2025-69534)
    * python3.12-jwcrypto: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373)
    * python3.12-pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)
    * python3.12-pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID     (CVE-2026-23490)
    * python3.12-pyOpenSSL: DTLS cookie callback buffer overflow (CVE-2026-27459)
    * receptor: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    For details about this release, refer to the release notes listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1013-1 advisory.

    dracut-saltboot:

    - Version update to 1.1.0:

      * Retry DHCP requests up to 3 times (bsc#1253004)

    golang-github-QubitProducts-exporter_exporter:

    - Non-customer-facing optimization and update

    golang-github-boynux-squid_exporter:

    - Version update from 1.6.0 to 1.13.0 with the following highlighted changes and fixes (jsc#PED-14971):

      * Added compatibility for Squid 6 and support for the squid-internal-mgr metrics path
      * Added TLS and Basic Authentication to the exporters web interface
      * Added support for the exporter to authenticate against the Squid proxy itself
      * Allow the gathering of process information without requiring root privileges
      * The exporter can now be configured using environment variables
      * Added support for custom labels to all exported metrics for better data filtering
      * New metrics to track if Squid is running (squid_up), how long a scrape takes, and if any errors     occurred
      * Added 'service time' metrics to analyze proxy speed and performance.
      * Added a metric for open file descriptors (process_open_fds) to help prevent connection bottlenecks
      * Corrected the squid_client_http_requests_total metric to ensure accurate reporting


    golang-github-lusitaniae-apache_exporter:

    - Version update from 1.0.8 to 1.0.10:

      * Updated github.com/prometheus/client_golang to 1.21.1
      * Updated github.com/prometheus/common to 0.63.0
      * Updated github.com/prometheus/exporter-toolkit to 0.14.0
      * Fixed signal handler logging

    golang-github-prometheus-prometheus:

    - Security issues fixed:

      * CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)
      * CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption     (bsc#1257841)
      * CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897,     bsc#1257442)
      * CVE-2025-13465: Bump lodash package to version 4.17.23 to fix prototype pollution vulnerability     (bsc#1257329)
      * CVE-2025-12816: Interpretation conflict vulnerability allowing bypassing cryptographic verifications     (bsc#1255588)

    - Version update from 2.53.4 to 3.5.0 with the following highlighted changes (jsc#PED-13824):

      * Modernized Interface: Introduced a brand-new UI
      * Enhanced Cloud and Auth: Added unified AWS service discovery (EC2, ECS, Lightsail) and Azure Workload     Identity support         for more secure, native cloudauthentication.
      * Performance Standards: Fully integrated OpenTelemetry (OTLP) ingestion and moved Native Histograms     from experimental         to a stable feature.
      * Advanced Data Export: Rolled out Remote Write 2.0, offering better performance and metadata handling     when sending         data to external systems.
      * Query Power: Added new PromQL functions (like first_over_time and last_over_time) and optimization for     grouping         operations
      * Better Visibility: The UI now displays detailed relabeling steps, scrape intervals, and timeouts,     making it easier         to troubleshoot why targets aren't reporting correctly.
      * Critical Fixes: Resolved significant memory leaks related to query logging and fixed bugs where     targets were         accidentally being scraped multiple times

    grafana:

    - Security issues fixed:

      * CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled     (bsc#1258136)
      * CVE-2026-21721: Fixed access control by the dashboard permissions API (bsc#1257337)
      * CVE-2026-21720: Fixed unauthenticated DoS (bsc#1257349)
      * CVE-2025-68156: Fixed potential DoS via unbounded recursion in builtin functions (bsc#1255340)
      * CVE-2025-3415: Fixedexposure of DingDing alerting integration URL to Viewer level users (bsc#1245302)

    - Version update from 11.5.10 to 11.6.11 with the following highlighted changes and fixes:

      * Performance Boost: Introduced WebGL-powered geomaps for smoother map visualizations and         removed blurred backgrounds from UI overlays to speed up the interface
      * One-Click Actions: Visualizations now support faster navigation via one-click links and actions
      * Alerting History: Added version history for alert rules, allowing you to track changes over time
      * Service Accounts: Automated the migration of old API keys to more secure Service Accounts upon startup
      * Cron Support: Annotations now support Cron syntax for more flexible scheduling
      * Identity and Auth: Hardened the Avatar feature (now requires sign-in) and fixed several login     redirection issues         when Grafana is hosted on a subpath
      * Data Source Support: Added support for Cloud Partner Prometheus data sources and improved Azure legend     formatting
      * Alerting Limits: Added size limits for expanded notification templates to prevent system strain
      * RBAC: Integrated Role-Based Access Control (RBAC) into the Alertmanager via the reqAction field
      * Data Consistency: Fixed several issues with Graphite and InfluxDB regarding how variables are handled     in repeated         rows or nested queries
      * Dashboard Reliability: Resolved bugs involving row repeats and 'self-referencing' data links
      * Alerting Fixes: Patched a critical 'panic' (crash) caused by a race condition in alert rules and fixed     issues where         contact points weren't working correctly
      * URL Handling: Fixed a bug where 'true' values in URL parameters weren't being read correctly

    prometheus-blackbox_exporter:

    - Non-customer-facing optimization and update

    spacecmd:

    - Version update to 5.0.15:

      * Fixed typo in spacecmd help ca-cert flag (bsc#1253174)
      * Convert cached IDs to integer values (bsc#1251995)
      * Fixed spacecmd binary file upload (bsc#1253659)

    uyuni-tools:

    - Version update to 0.1.38:

      * Fixed cobbler configuration when migrating to standalone files (bsc#1256803)
      * Detect custom apache and squid config in the /etc/uyuni/proxy folder
      * Add ssh tuning to configure sshd (bsc#1253738)
      * Ignore supportconfig errors (bsc#1255781)
      * Bumped the default image tag to 5.0.7
      * Removed cgroup mount for podman containers (bsc#1253347)
      * Registry flag can be a string (bsc#1254589)
      * Use static supportconfig name to avoid dynamic search (bsc#1257941)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0168 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-27606:
    Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup     module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write     via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control     output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use     traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has     permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or     user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup
    module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write
    via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control
    output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use
    traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has
    permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or
    user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.
    (CVE-2026-27606)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup     module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write     via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control     output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use     traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has     permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or     user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.
    (CVE-2026-27606)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
312098	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Important) (RHSA-2026:13512)	Nessus	Red Hat Local Security Checks	critical
312090	RHEL 10 / 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Important) (RHSA-2026:13508)	Nessus	Red Hat Local Security Checks	critical
303779	SUSE SLES15: dracut-saltboot / golang-github-QubitProducts-exporter_exporter / etc (SUSE-SU-2026:1013-1)	Nessus	SuSE Local Security Checks	critical
302521	TencentOS Server 4: grafana (TSSA-2026:0168)	Nessus	Tencent Local Security Checks	critical
438026	SCA: security update for rollup (GHSA-mw96-cpmx-2vgc)	Tenable Cloud Security	SCA Checks	critical
438026	SCA: security update for rollup (GHSA-mw96-cpmx-2vgc)	Tenable Self-Hosted Container Security	SCA Checks	critical
300045	Linux Distros Unpatched Vulnerability : CVE-2026-27606	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-27606

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical