CVE-2024-9620: Event-driven automation in ansible automation platform (aap): ansible event-driven automation (eda) lacks encryption

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-08 · updated 2026-06-17
Weakness: CWE-319

Description

A flaw was found in Event-Driven Automation (EDA) in Ansible Automation Platform (AAP), which lacks encryption of sensitive information. An attacker with network access could exploit this vulnerability by sniffing the plaintext data transmitted between the EDA and AAP. An attacker with system access could exploit this vulnerability by reading the plaintext data stored in EDA and AAP databases.

Affected products

Red Hat Ansible Automation Platform 2: all versions

References

https://access.redhat.com/security/cve/CVE-2024-9620
https://bugzilla.redhat.com/show_bug.cgi?id=2317129

Get alerted when CVE-2024-9620 or the next vulnerability affects your stack