Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security Update

Fixed packages 1

Vulnerabilities 1

• High 8.5
  CVE-2025-14025

  Ansible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictions

  A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. However, this vulnerability allows read-only tokens to perform write operations on backend ser…

  Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.6 for RHEL 9
  Jan 8, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2418785
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0360.json
• report
  https://access.redhat.com/security/cve/CVE-2025-14025
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-14025
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-14025
• article
  https://access.redhat.com/articles/7136004