What’s Vulnerable › Vulnerabilities

CVE-2025-49520: Event-driven-ansible: authenticated argument injection in git url in eda project creation

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-30 · updated 2026-06-17
• Weakness: CWE-88

Description

A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerability allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes/OpenShift environments, this can lead to service account token theft and cluster access.

Affected products

• Red Hat Ansible Automation Platform 2.5 for RHEL 8: all versions — fixed in 0:1.1.11-1.el8ap
• Red Hat Ansible Automation Platform 2.5 for RHEL 9: all versions — fixed in 0:1.1.11-1.el9ap

How to fix

Upgrade to a fixed version: Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:1.1.11-1.el8ap; Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:1.1.11-1.el9ap. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2025:9986
• https://access.redhat.com/security/cve/CVE-2025-49520
• https://bugzilla.redhat.com/show_bug.cgi?id=2370812

Get alerted when CVE-2025-49520 or the next vulnerability affects your stack