Every CVE Search/ Get API key

CVE-2025-49520

Event-driven-ansible: authenticated argument injection in git url in eda project creation

8.8 High

A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerability allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes/OpenShift environments, this can lead to service account token theft and cluster access.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.62%Up 0.5 points since Jul 1, 2025
90%50%10%1%

What each source reports

CVE List Score used 8.8

Event-driven-ansible: authenticated argument injection in git url in eda project creation

A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerability allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes/OpenShift environments, this can lead to service account token theft and cluster access.

Record
CVE-2025-49520
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-88
Updated
2026-11-03
EUVDEUVD-2025-19585 8.8

A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerability allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes/OpenShift environments, this can lead to service account token theft and cluster access.

Record
EUVD-2025-19585
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-wxwr-926x-hcq6 8.8

A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are...

A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerability allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes/OpenShift environments, this can lead to service account token theft and cluster access.

Record
GHSA-wxwr-926x-hcq6
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-88
Updated
2026-11-02
NVD 8.8

A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerability allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes/OpenShift environments, this can lead to service account token theft and cluster access.

Record
CVE-2025-49520
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-88
Updated
2026-11-03
OSVRHSA-2025:9986 8.8

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Record
RHSA-2025:9986
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
receptor
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 3 CVEs
 before 0:1.5.7-2.el8ap
0:1.5.7-2.el8ap
receptorctl
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 3 CVEs
 before 0:1.5.7-2.el8ap
0:1.5.7-2.el8ap
receptor
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 3 CVEs
 before 0:1.5.7-2.el8ap
0:1.5.7-2.el8ap
receptorctl
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 3 CVEs
 before 0:1.5.7-2.el8ap
0:1.5.7-2.el8ap
automation-gateway-proxy
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 3 CVEs
 before 0:2.5.10-2.el8ap
0:2.5.10-2.el8ap
automation-gateway-proxy-debugsource
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 3 CVEs
 before 0:2.5.10-2.el8ap
0:2.5.10-2.el8ap
automation-gateway-proxy-server
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 3 CVEs
 before 0:2.5.10-2.el8ap
0:2.5.10-2.el8ap
automation-gateway-proxy-server-debuginfo
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 3 CVEs
 before 0:2.5.10-2.el8ap
0:2.5.10-2.el8ap
receptor
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 3 CVEs
 before 0:1.5.7-2.el8ap
0:1.5.7-2.el8ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 3 CVEs
 before 0:1.5.7-2.el8ap
0:1.5.7-2.el8ap
Show 28 moreShow less
Affected packages
PackageAffectedFixed
receptor-debugsource
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 3 CVEs
 before 0:1.5.7-2.el8ap
0:1.5.7-2.el8ap
receptorctl
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 3 CVEs
 before 0:1.5.7-2.el8ap
0:1.5.7-2.el8ap
receptor
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 3 CVEs
 before 0:1.5.7-2.el9ap
0:1.5.7-2.el9ap
receptorctl
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 3 CVEs
 before 0:1.5.7-2.el9ap
0:1.5.7-2.el9ap
receptor
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 3 CVEs
 before 0:1.5.7-2.el9ap
0:1.5.7-2.el9ap
receptorctl
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 3 CVEs
 before 0:1.5.7-2.el9ap
0:1.5.7-2.el9ap
automation-gateway-proxy-openssl30
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 3 CVEs
 before 0:2.6.6-2.el9ap
0:2.6.6-2.el9ap
automation-gateway-proxy-openssl30-debugsource
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 3 CVEs
 before 0:2.6.6-2.el9ap
0:2.6.6-2.el9ap
automation-gateway-proxy-openssl30-server
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 3 CVEs
 before 0:2.6.6-2.el9ap
0:2.6.6-2.el9ap
automation-gateway-proxy-openssl30-server-debuginfo
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 3 CVEs
 before 0:2.6.6-2.el9ap
0:2.6.6-2.el9ap
automation-gateway-proxy-openssl32
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 3 CVEs
 before 0:2.6.6-2.el9ap
0:2.6.6-2.el9ap
automation-gateway-proxy-openssl32-debugsource
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 3 CVEs
 before 0:2.6.6-2.el9ap
0:2.6.6-2.el9ap
automation-gateway-proxy-openssl32-server
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 3 CVEs
 before 0:2.6.6-2.el9ap
0:2.6.6-2.el9ap
automation-gateway-proxy-openssl32-server-debuginfo
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 3 CVEs
 before 0:2.6.6-2.el9ap
0:2.6.6-2.el9ap
receptor
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 3 CVEs
 before 0:1.5.7-2.el9ap
0:1.5.7-2.el9ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 3 CVEs
 before 0:1.5.7-2.el9ap
0:1.5.7-2.el9ap
receptor-debugsource
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 3 CVEs
 before 0:1.5.7-2.el9ap
0:1.5.7-2.el9ap
receptorctl
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 3 CVEs
 before 0:1.5.7-2.el9ap
0:1.5.7-2.el9ap
automation-eda-controller
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 3 CVEs
 before 0:1.1.11-1.el8ap
0:1.1.11-1.el8ap
automation-eda-controller-base
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 3 CVEs
 before 0:1.1.11-1.el8ap
0:1.1.11-1.el8ap
automation-eda-controller-base-services
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 3 CVEs
 before 0:1.1.11-1.el8ap
0:1.1.11-1.el8ap
automation-eda-controller-event-stream-services
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 3 CVEs
 before 0:1.1.11-1.el8ap
0:1.1.11-1.el8ap
automation-eda-controller-worker-services
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 3 CVEs
 before 0:1.1.11-1.el8ap
0:1.1.11-1.el8ap
automation-eda-controller
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 3 CVEs
 before 0:1.1.11-1.el9ap
0:1.1.11-1.el9ap
automation-eda-controller-base
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 3 CVEs
 before 0:1.1.11-1.el9ap
0:1.1.11-1.el9ap
automation-eda-controller-base-services
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 3 CVEs
 before 0:1.1.11-1.el9ap
0:1.1.11-1.el9ap
automation-eda-controller-event-stream-services
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 3 CVEs
 before 0:1.1.11-1.el9ap
0:1.1.11-1.el9ap
automation-eda-controller-worker-services
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 3 CVEs
 before 0:1.1.11-1.el9ap
0:1.1.11-1.el9ap

History

History
RecordedChangedSources
affected, facts
factsCVE List, EUVD, NVD
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-49520 is a high vulnerability (CVSS 8.8) in Red Hat Ansible Automation Platform 2.5 For Rhel 8, published June 30, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.62%, the 50th percentile. No source names a fixed version.

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open