PT-2026-1730 · Red Hat · Ansible Automation Platform

Published 2026-01-08 · Updated 2026-01-08 · CVE-2025-14025

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform (AAP) (affected versions not specified)

Description A flaw exists in Ansible Automation Platform (AAP) where read-only scoped OAuth2 API Tokens, enforced at the Gateway level for Gateway-specific operations, can be used to perform write operations on backend services such as the Controller, Hub, and EDA. Exploitation of this issue could allow an attacker’s capabilities to be limited only by role based access controls (RBAC).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-279

Related Identifiers

CVE-2025-14025

RHSA-2026:0360

RHSA-2026:0361

Affected Products

Ansible Automation Platform

References · 14

• https://access.redhat.com/errata/RHSA-2026:0360 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:0409 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14025 · Security Note
• https://access.redhat.com/errata/RHSA-2026:0361 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:0408 · Vendor Advisory
• https://t.me/CVEtracker/41714 · Telegram Post
• https://t.me/cveNotify/148146 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2418785 · Note
• https://twitter.com/CveFindCom/status/2009273710578921705 · Twitter Post
• https://twitter.com/TheHackerWire/status/2009279046195269650 · Twitter Post
• https://t.me/cveNotify/148079 · Telegram Post
• https://access.redhat.com/articles/7136004 · Note
• https://twitter.com/CVEnew/status/2009269782433157613 · Twitter Post
• https://access.redhat.com/security/cve/CVE-2025-14025 · Note