VDB

CVE-2025-14025

CVE-2025-14025 PUBLISHED CVSS 8.5 HIGH

A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. However, this vulnerability allows read-only tokens to perform write operations on backend services (e.g., Controller, Hub, EDA). If this flaw were exploited, an attacker‘s capabilities would only be limited by role based access controls (RBAC).

EPSS 0.02% · 5.7th percentile

Risk Scores

CVSS 3.1
8.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score
0.02%
5.7th percentile

Affected Products

VendorProductVersions
Red HatRed Hat Ansible Automation Platform 2.5sha256:2df290b61d7aac08deec2973d0a9b98788f6b619e974af0b3f4b61c759c7e464, sha256:2df290b61d7aac08deec2973d0a9b98788f6b619e974af0b3f4b61c759c7e464
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 90:2.6.20260106-1.el9ap, 0:2.6.20260106-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:2.5.20260106-1.el9ap, 0:2.5.20260106-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.6sha256:766c7570afc4e9b163a3256a0d7c699327905c1d24213229acb0b96a9e65b615, sha256:766c7570afc4e9b163a3256a0d7c699327905c1d24213229acb0b96a9e65b615
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:2.5.20260106-1.el8ap, 0:2.5.20260106-1.el8ap

Timeline

  • Jan 8, 2026 CVE Published
  • Jan 8, 2026 PoC Published
  • Jan 8, 2026 PoC Published
  • Jan 8, 2026 PoC Published
  • Jan 8, 2026 PoC Published
  • Jan 8, 2026 PoC Published
  • Jan 9, 2026 EPSS Score
  • Jan 12, 2026 EPSS Score
  • Jan 15, 2026 EPSS Score
  • Jan 18, 2026 EPSS Score
  • Jan 22, 2026 EPSS Score
  • Jan 25, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›