CVE-2025-14025: Ansible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictions

Severity: high (CVSS 8.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-08 · updated 2026-06-17
Weakness: CWE-279

Description

A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. However, this vulnerability allows read-only tokens to perform write operations on backend services (e.g., Controller, Hub, EDA). If this flaw were exploited, an attacker‘s capabilities would only be limited by role based access controls (RBAC).

Affected products

Red Hat Ansible Automation Platform 2.5: all versions — fixed in sha256:2df290b61d7aac08deec2973d0a9b98788f6b619e974af0b3f4b61c759c7e464
Red Hat Ansible Automation Platform 2.5 for RHEL 8: all versions — fixed in 0:2.5.20260106-1.el8ap
Red Hat Ansible Automation Platform 2.5 for RHEL 9: all versions — fixed in 0:2.5.20260106-1.el9ap
Red Hat Ansible Automation Platform 2.6: all versions — fixed in sha256:766c7570afc4e9b163a3256a0d7c699327905c1d24213229acb0b96a9e65b615
Red Hat Ansible Automation Platform 2.6 for RHEL 9: all versions — fixed in 0:2.6.20260106-1.el9ap

How to fix

Upgrade to a fixed version: Red Hat Ansible Automation Platform 2.5 sha256:2df290b61d7aac08deec2973d0a9b98788f6b619e974af0b3f4b61c759c7e464; Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:2.5.20260106-1.el8ap; Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:2.5.20260106-1.el9ap; Red Hat Ansible Automation Platform 2.6 sha256:766c7570afc4e9b163a3256a0d7c699327905c1d24213229acb0b96a9e65b615; Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:2.6.20260106-1.el9ap. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-14025 or the next vulnerability affects your stack