CVE-2026-7246
Fixed in a distro release EPSS <1%CVSS 7.2
This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below: Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Products: Pallets Click Click, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 10, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Ansible Automation Platform 2
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | click | 8.3.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | python3-click | 7.1.2-5.amzn2023.0.3 |
| Debian 12 | python-click | no fix |
| Debian 13 | python-click | no fix |
| Debian 14 | python-click | 8.3.3-1 |
| Red Hat ansible automation platform 2.5 | automation-controller-venv-tower | 0:4.6.29-2.el8ap |
| Red Hat ansible automation platform 2.5 | automation-controller-venv-tower | 0:4.6.29-2.el9ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-proxy-server | 0:2.5.10-6.el8ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-proxy-server | 0:2.6.14-3.el9ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-server | 0:2.5.20260422-3.el9ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-server | 0:2.5.20260422-3.el8ap |
| Red Hat ansible automation platform 2.5 | python3.12-click | 0:8.3.3-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.12-click | 0:8.3.3-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.12-cryptography | 0:46.0.7-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.12-cryptography | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.12-pillow | 0:12.2.0-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.12-pillow | 0:12.2.0-1.el9ap |
| Red Hat ansible automation platform 2.5 | receptor | 0:1.6.5-1.el9ap |
| Red Hat ansible automation platform 2.5 | receptor | 0:1.6.5-1.el8ap |
| Red Hat ansible automation platform 2.6 | automation-controller | 0:4.7.12-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-cli | 0:4.7.12-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-server | 0:4.7.12-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-ui | 0:4.7.12-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-venv-tower | 0:4.7.12-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-gateway-proxy | 0:2.6.14-3.el9ap |
| Red Hat ansible automation platform 2.6 | automation-gateway-proxy-debugsource | 0:2.6.14-3.el9ap |
| Red Hat ansible automation platform 2.6 | automation-gateway-proxy-server | 0:2.6.14-3.el9ap |
| Red Hat ansible automation platform 2.6 | automation-gateway-proxy-server-debuginfo | 0:2.6.14-3.el9ap |
| Red Hat ansible automation platform 2.6 | automation-platform-ui | 0:2.6.9-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3-click | 0:8.3.3-1.el10ap |
| Red Hat ansible automation platform 2.6 | python3.12-click | 0:8.3.3-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-cryptography | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-cryptography-debuginfo | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-cryptography-debugsource | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-pillow | 0:12.2.0-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-pillow-debuginfo | 0:12.2.0-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-pillow-debugsource | 0:12.2.0-1.el9ap |
| Red Hat ansible automation platform 2.6 | receptor | 0:1.6.5-1.el9ap |
| Red Hat ansible automation platform 2.6 | receptor | 0:1.6.5-1.el10ap |
| Red Hat ansible automation platform 2.6 | receptor-debuginfo | 0:1.6.5-1.el10ap |
| Red Hat ansible automation platform 2.6 | receptor-debuginfo | 0:1.6.5-1.el9ap |
| Red Hat ansible automation platform 2.6 | receptor-debugsource | 0:1.6.5-1.el10ap |
| Red Hat ansible automation platform 2.6 | receptor-debugsource | 0:1.6.5-1.el9ap |
| Red Hat ansible automation platform 2.6 | receptorctl | 0:1.6.5-1.el9ap |
| Red Hat ansible automation platform 2.6 | receptorctl | 0:1.6.5-1.el10ap |
| Red Hat ansible automation platform developer 2.5 | python3.12-click | 0:8.3.3-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | python3.12-click | 0:8.3.3-1.el8ap |
| Red Hat ansible automation platform developer 2.5 | python3.12-cryptography | 0:46.0.7-1.el8ap |
| Red Hat ansible automation platform developer 2.5 | python3.12-cryptography | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | receptor | 0:1.6.5-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | receptor | 0:1.6.5-1.el8ap |
| Red Hat ansible automation platform developer 2.6 | automation-controller | 0:4.7.12-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | automation-controller-cli | 0:4.7.12-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | python3-click | 0:8.3.3-1.el10ap |
| Red Hat ansible automation platform developer 2.6 | python3.12-click | 0:8.3.3-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | python3.12-cryptography | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | python3.12-cryptography-debuginfo | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | python3.12-cryptography-debugsource | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | receptor | 0:1.6.5-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | receptorctl | 0:1.6.5-1.el9ap |
| Red Hat ansible automation platform inside 2.5 | python3.12-click | 0:8.3.3-1.el8ap |
| Red Hat ansible automation platform inside 2.5 | python3.12-click | 0:8.3.3-1.el9ap |
| Red Hat ansible automation platform inside 2.5 | python3.12-cryptography | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform inside 2.5 | python3.12-cryptography | 0:46.0.7-1.el8ap |
| Red Hat ansible automation platform inside 2.5 | receptor | 0:1.6.5-1.el9ap |
| Red Hat ansible automation platform inside 2.5 | receptor | 0:1.6.5-1.el8ap |
| Red Hat ansible automation platform inside 2.6 | python3.12-click | 0:8.3.3-1.el9ap |
| Red Hat ansible automation platform inside 2.6 | python3.12-cryptography | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform inside 2.6 | python3.12-cryptography-debuginfo | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform inside 2.6 | python3.12-cryptography-debugsource | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform inside 2.6 | receptor | 0:1.6.5-1.el9ap |
| Red Hat ansible automation platform inside 2.6 | receptorctl | 0:1.6.5-1.el9ap |
| SUSE Linux Enterprise Server 16.0 | python-click | 8.2.1-160000.3.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | python-click | 8.2.1-160000.3.1 |
| SUSE Linux Micro 6.2 | python-click | 8.2.1-160000.3.1 |
| Ubuntu 16.04 LTS | python-click | no fix |
| Ubuntu 18.04 LTS | python-click | no fix |
| Ubuntu 20.04 LTS | python-click | no fix |
| Ubuntu 22.04 LTS | python-click | no fix |
| Ubuntu 24.04 LTS | python-click | no fix |
| Ubuntu 25.10 | python-click | no fix |
| Ubuntu 26.04 | python-click | no fix |
| openSUSE Leap 16.0 | python-click | 8.2.1-160000.3.1 |
| openSUSE Tumbleweed | python-click | 8.3.3-2.1 |