Description (CNA)
A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. However, this vulnerability allows read-only tokens to perform write operations on backend services (e.g., Controller, Hub, EDA). If this flaw were exploited, an attacker‘s capabilities would only be limited by role based access controls (RBAC).
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / Red Hat Ansible Automation Platform 2.5 for RHEL 8 | unaffected 0:2.5.20260106-1.el8ap before * |
| Red Hat / Red Hat Ansible Automation Platform 2.5 for RHEL 9 | unaffected 0:2.5.20260106-1.el9ap before * |
| Red Hat / Red Hat Ansible Automation Platform 2.6 for RHEL 9 | unaffected 0:2.6.20260106-1.el9ap before * |
| Red Hat / Red Hat Ansible Automation Platform 2.5 | unaffected sha256:2df290b61d7aac08deec2973d0a9b98788f6b619e974af0b3f4b61c759c7e464 before * |
| Red Hat / Red Hat Ansible Automation Platform 2.6 | unaffected sha256:766c7570afc4e9b163a3256a0d7c699327905c1d24213229acb0b96a9e65b615 before * |
CWE
CWE-279
References
- https://access.redhat.com/articles/7136004
- https://access.redhat.com/errata/RHSA-2026:0360
- https://access.redhat.com/errata/RHSA-2026:0361
- https://access.redhat.com/errata/RHSA-2026:0408
- https://access.redhat.com/errata/RHSA-2026:0409
- https://access.redhat.com/security/cve/CVE-2025-14025
- https://bugzilla.redhat.com/show_bug.cgi?id=2418785
ADP enrichment
No English description supplied.
No references supplied.