Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Fixed packages 4

Vulnerabilities 2

• Medium 5.3
  CVE-2025-5988

  Aap-gateway: csrf origin checking is disabled

  A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda.

  Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8
  Aug 4, 2025
• Medium 4.4
  CVE-2025-7738

  Python3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aap

  A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear text. This vulnerability affects administrators or auditors accessing authenticator configurations. Whi…

  Red Hat Ansible Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.5 for RHEL 9
  Jul 31, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2371644
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2381589
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_12772.json
• report
  https://access.redhat.com/security/cve/CVE-2025-5988
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-5988
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-5988
• report
  https://access.redhat.com/security/cve/CVE-2025-7738
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-7738
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-7738
• article
  https://github.com/ansible/django-ansible-base/commit/e241ea4dce8df577eda15301e0a8e61be647b27b
• article
  https://github.com/ansible/django-ansible-base/pull/773