Description
A vulnerability was found in the Ansible Automation Platform (AAP). This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansible_base.oauth2_provider for OAuth2 authentication. While the impact is limited to actions within the user’s assigned permissions, it undermines scoped access controls, potentially allowing unintended modifications in the application and consuming services.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | django-ansible-base | ≤ v2024.10.17 | — |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform Inside 2 | ansible-core | 1:2.16.14-1.el8ap | RHSA-2024:11145 |
| Red Hat Ansible Automation Platform Developer 2 | ansible-core | 1:2.16.14-1.el8ap | RHSA-2024:11145 |
| Red Hat Ansible Automation Platform 2 | ansible-core | 1:2.16.14-1.el8ap | RHSA-2024:11145 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-server | 2.5.20241218-1.el8ap | RHSA-2024:11145 |
Advisories 2
- RHSA-2024:11145 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- WID-SEC-2024-3705 Red Hat Ansible Automation Platform: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Dec 16, 2024
References
- RHSA-2024:11145 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-11483 vdb-entry
- RHBZ#2327579 issue-tracking
- https://github.com/ansible/django-ansible-base/commit/845b3e1838cc0762a7f9f3e0379c5274519d9a44