CVE-2025-14025highCWE-279

CVE-2025-14025: fallo de gravedad alta en Red Hat Ansible Automation Platform 2.5

Ansible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictions

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Red Hat Ansible Automation Platform

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.5epss 0.4%
A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. However, this vulnerability allows read-only tokens to perform write operations on backend services (e.g., Controller, Hub, EDA). If this flaw were exploited, an attacker‘s capabilities would only be limited by role based access controls (RBAC).
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Productos afectados
Red Hat · Red Hat Ansible Automation Platform 2.5Red Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat · Red Hat Ansible Automation Platform 2.6Red Hat · Red Hat Ansible Automation Platform 2.6 for RHEL 9
CVEs relacionadas — Red Hat Ansible Automation Platform 2.5

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-71364HIGHAwx: project archive extraction allows path traversal file writesEPSS 1.7%CVE-2026-12701CRITICALPulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexportEPSS 1.2%CVE-2026-84474CRITICALAutomation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioning-callback host matchEPSS 0.8%CVE-2026-84502CRITICALAutomation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane podEPSS 0.6%CVE-2025-49520HIGHEvent-driven-ansible: authenticated argument injection in git url in eda project creationEPSS 0.6%CVE-2025-49521HIGHEvent-driven-ansible: template injection via git branch and refspec in eda projectsEPSS 0.6%