PT-2025-27477 · Ansible · Ansible Automation Platform

Published 2025-06-30 · Updated 2025-07-14 · CVE-2025-49521

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Ansible Automation Platform (affected versions not specified)

Description: A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This issue allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In OpenShift, it can lead to service account token theft.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2026-00136

CVE-2025-49521

RHSA-2025:9986

Affected Products

Ansible Automation Platform

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-49521 · Security Note
• https://bdu.fstec.ru/vul/2026-00136 · Security Note
• https://access.redhat.com/errata/RHSA-2025:9986 · Vendor Advisory
• https://twitter.com/CveFindCom/status/1939793653884412354 · Twitter Post
• https://twitter.com/Hossted_OSS/status/1944673054132433122 · Twitter Post
• https://t.me/cvetracker/27465 · Telegram Post
• https://access.redhat.com/security/cve/CVE-2025-49521 · Note
• https://t.me/cvenotify/127172 · Telegram Post
• https://twitter.com/CVEnew/status/1939789251630997828 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2370817 · Note
• https://t.me/cvenotify/127199 · Telegram Post