PT-2026-1730 · Red Hat · Ansible Automation Platform

CVE-2025-14025 · Publicado 2026-01-08 · Atualizado 2026-01-08

Positive Technologies (AI Summary)

CVSS v3.1

8.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform (AAP) (affected versions not specified)

Description A flaw exists in Ansible Automation Platform (AAP) where read-only scoped OAuth2 API Tokens, enforced at the Gateway level for Gateway-specific operations, can be used to perform write operations on backend services such as the Controller, Hub, and EDA. Exploitation of this issue could allow an attacker’s capabilities to be limited only by role based access controls (RBAC).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-279

Identificadores relacionados

CVE-2025-14025

RHSA-2026:0360

RHSA-2026:0361

Produtos afetados

Ansible Automation Platform

Referências · 14

• https://t.me/CVEtracker/41714 · Publicação no Telegram
• https://access.redhat.com/errata/RHSA-2026:0360 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2026:0409 · Aviso do Fabricante
• https://t.me/cveNotify/148146 · Publicação no Telegram
• https://bugzilla.redhat.com/show_bug.cgi?id=2418785 · Nota
• https://twitter.com/CveFindCom/status/2009273710578921705 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2009279046195269650 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-14025 · Nota de Segurança
• https://t.me/cveNotify/148079 · Publicação no Telegram
• https://access.redhat.com/articles/7136004 · Nota
• https://twitter.com/CVEnew/status/2009269782433157613 · Publicação no Twitter
• https://access.redhat.com/security/cve/CVE-2025-14025 · Nota
• https://access.redhat.com/errata/RHSA-2026:0361 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2026:0408 · Aviso do Fabricante