CVE-2025-53861: low-severity vulnerability in Red Hat Ansible Automation Platform 2
Aap: sensitive cookie(s) set without security flags
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.1epss 0.1%
A flaw was found in Ansible. Sensitive cookies without security flags over non-encrypted channels can lead to Man-in-the-Middle (MitM) and Cross-site scripting (XSS) attacks allowing attackers to read transmitted data.
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Red Hat · Red Hat Ansible Automation Platform 2Related CVEs — Red Hat Ansible Automation Platform 2
In the same product, most dangerous first.
CVE-2024-3727HIGHContainers/image: digest type does not guarantee valid typeEPSS 1.3%CVE-2026-12701CRITICALPulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexportEPSS 1.2%CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%CVE-2023-50782HIGHPython-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659EPSS 1.1%CVE-2026-44189HIGHAnsible-lightspeed: visual studio code ansible lightspeed extension: arbitrary code execution via malicious playbook filenameEPSS 1.0%CVE-2026-12398HIGHGalaxy_ng: shell injection in legacy role import via unsanitized git ref namesEPSS 0.9%