Description
A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In OpenShift, it can lead to service account token theft.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform Inside 2 | receptor +1 | 1.5.7-2.el8ap | RHSA-2025:9986 |
| Red Hat Ansible Automation Platform Developer 2 | receptor +1 | 1.5.7-2.el8ap | RHSA-2025:9986 |
| Red Hat Ansible Automation Platform 2 | automation-eda-controller +4 | 1.1.11-1.el8ap | RHSA-2025:9986 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy +1 | 2.5.10-2.el8ap | RHSA-2025:9986 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy-openssl30 +3 | 2.6.6-2.el9ap | RHSA-2025:9986 |
| Red Hat Ansible Automation Platform 2 | receptor +1 | 1.5.7-2.el8ap | RHSA-2025:9986 |
Advisories 2
- RHSA-2025:9986 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- WID-SEC-2025-1437 Red Hat Ansible Automation Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 4, 2025
References
- RHSA-2025:9986 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-49521 vdb-entry
- RHBZ#2370817 issue-tracking