8.8
Élevée
CVE-2025-49520 A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to…
Description
A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerability allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes/OpenShift environments, this can lead to service account token theft and cluster access.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Versions non publiées | |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Versions non publiées |
Références
- RHSA-2025:9986 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2370812 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat Ansible Automation Platform 2.5 for RHEL 8
Les 100 CVE de Red Hat Ansible Automation Platform 2.5 for RHEL 8 →
CVE-2026-84724
Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process
6.6
Moyenne
CVE-2026-84720
Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracle
6.5
Moyenne
CVE-2026-84718
Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust
4.3
Moyenne
CVE-2026-84717
Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templates
5.3
Moyenne