Description
A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerability allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes/OpenShift environments, this can lead to service account token theft and cluster access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform Inside 2 | receptor +1 | 1.5.7-2.el8ap | RHSA-2025:9986 |
| Red Hat Ansible Automation Platform Developer 2 | receptor +1 | 1.5.7-2.el8ap | RHSA-2025:9986 |
| Red Hat Ansible Automation Platform 2 | automation-eda-controller +4 | 1.1.11-1.el8ap | RHSA-2025:9986 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy +1 | 2.5.10-2.el8ap | RHSA-2025:9986 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy-openssl30 +3 | 2.6.6-2.el9ap | RHSA-2025:9986 |
| Red Hat Ansible Automation Platform 2 | receptor +1 | 1.5.7-2.el8ap | RHSA-2025:9986 |
Advisories 2
- RHSA-2025:9986 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- WID-SEC-2025-1437 Red Hat Ansible Automation Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 4, 2025
References
- RHSA-2025:9986 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-49520 vdb-entry
- RHBZ#2370812 issue-tracking