PT-2025-27476 · Unknown · Ansible Automation Platform

Published 2025-06-30 · Updated 2025-07-01 · CVE-2025-49520

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Ansible Automation Platform (affected versions not specified)

Description: A flaw was found in Ansible Automation Platform's EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This issue allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes/OpenShift environments, this can lead to service account token theft and cluster access.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

BDU:2026-00135

CVE-2025-49520

RHSA-2025:9986

Affected Products

Ansible Automation Platform

References · 12

• https://bdu.fstec.ru/vul/2026-00135 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-49520 · Security Note
• https://access.redhat.com/errata/RHSA-2025:9986 · Vendor Advisory
• https://t.me/purp_sec/833 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2370812 · Note
• https://twitter.com/CVEnew/status/1939789250716692721 · Twitter Post
• https://t.me/cvetracker/27464 · Telegram Post
• https://t.me/cvenotify/127171 · Telegram Post
• https://access.redhat.com/security/cve/CVE-2025-49520 · Note
• https://t.me/cvenotify/127198 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1939846170077003940 · Twitter Post
• https://twitter.com/CveFindCom/status/1939793682862903405 · Twitter Post