What’s Vulnerable › Vulnerabilities

CVE-2025-49521: Event-driven-ansible: template injection via git branch and refspec in eda projects

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-30 · updated 2026-06-17
• Weakness: CWE-94

Description

A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In OpenShift, it can lead to service account token theft.

Affected products

• Red Hat Ansible Automation Platform 2.5 for RHEL 8: all versions — fixed in 0:1.1.11-1.el8ap
• Red Hat Ansible Automation Platform 2.5 for RHEL 9: all versions — fixed in 0:1.1.11-1.el9ap

How to fix

Upgrade to a fixed version: Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:1.1.11-1.el8ap; Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:1.1.11-1.el9ap. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2025:9986
• https://access.redhat.com/security/cve/CVE-2025-49521
• https://bugzilla.redhat.com/show_bug.cgi?id=2370817

Get alerted when CVE-2025-49521 or the next vulnerability affects your stack