Red Hat Red Hat Ansible Automation Platform 2.5 For Rhel 8
21 CVEs affecting Red Hat Red Hat Ansible Automation Platform 2.5 For Rhel 8. Latest disclosed: 2026-07-27. Critical: 2, High: 8.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-11807 | Critical | 9.6 | 2026-06-23 | A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user… |
CVE-2026-12701 | Critical | 9.0 | 2026-07-20 | A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to… |
CVE-2025-49521 | High | 8.8 | 2025-06-30 | A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. T… |
CVE-2025-49520 | High | 8.8 | 2025-06-30 | A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerab… |
CVE-2025-14025 | High | 8.5 | 2026-01-08 | A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operat… |
CVE-2026-6266 | High | 8.3 | 2026-05-04 | A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an… |
CVE-2026-12382 | High | 8.2 | 2026-07-15 | A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requ… |
CVE-2025-1801 | High | 8.1 | 2025-03-03 | A flaw was found in the Ansible aap-gateway. Concurrent requests handled by the gateway grpc service can result in concurrency issues due to race condition req… |
CVE-2026-11332 | High | 7.8 | 2026-06-05 | A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to… |
CVE-2026-12383 | High | 7.5 | 2026-07-27 | A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowAny], authe… |
CVE-2025-9909 | Medium | 6.7 | 2026-02-27 | A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of mi… |
CVE-2025-9908 | Medium | 6.7 | 2026-02-27 | A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Streams. This vulnerability allows an authenticated user to gain… |
CVE-2025-9907 | Medium | 6.7 | 2026-02-27 | A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerability allows exposure of sensitive clien… |
CVE-2025-2877 | Medium | 6.5 | 2025-03-28 | A flaw was found in the Ansible Automation Platform's Event-Driven Ansible. In configurations where verbosity is set to "debug", inventory passwords are expose… |
CVE-2024-9902 | Medium | 6.3 | 2024-11-06 | A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system… |
CVE-2024-10033 | Medium | 6.1 | 2024-10-16 | A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perf… |
CVE-2024-11079 | Medium | 5.5 | 2024-11-12 | A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute t… |
CVE-2024-8775 | Medium | 5.5 | 2024-09-14 | A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occ… |
CVE-2025-5988 | Medium | 5.3 | 2025-08-04 | A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to external components… |
CVE-2024-11483 | Medium | 5.0 | 2024-11-25 | A vulnerability was found in the Ansible Automation Platform (AAP). This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAut… |