CVE-2025-5988
Fixed in a distro release EPSS <1%CVSS 5.3
A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda.
Products: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat ansible automation platform 2.5 | automation-gateway-server | 0:2.5.20250730-2.el8ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-server | 0:2.5.20250730-2.el9ap |
| Red Hat ansible automation platform 2.5 | python3.11-django-ansible-base | 0:2.5.20250730-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.11-django-ansible-base | 0:2.5.20250730-1.el9ap |