CVE-2025-49521
Event-driven-ansible: template injection via git branch and refspec in eda projects
A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In OpenShift, it can lead to service account token theft.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Event-driven-ansible: template injection via git branch and refspec in eda projects
A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In OpenShift, it can lead to service account token theft.
- Record
CVE-2025-49521- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-03
EUVDEUVD-2025-19586
A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In OpenShift, it can lead to service account token theft.
- Record
EUVD-2025-19586- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g6ph-9xfv-87c2
A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git...
A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In OpenShift, it can lead to service account token theft.
- Record
GHSA-g6ph-9xfv-87c2- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In OpenShift, it can lead to service account token theft.
- Record
CVE-2025-49521- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-03
OSVRHSA-2025:9986
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Record
RHSA-2025:9986- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
receptorRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 3 CVEs |
before 0:1.5.7-2.el8ap | 0:1.5.7-2.el8ap |
receptorctlRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 3 CVEs |
before 0:1.5.7-2.el8ap | 0:1.5.7-2.el8ap |
receptorRed Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 3 CVEs |
before 0:1.5.7-2.el8ap | 0:1.5.7-2.el8ap |
receptorctlRed Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 3 CVEs |
before 0:1.5.7-2.el8ap | 0:1.5.7-2.el8ap |
automation-gateway-proxyRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 3 CVEs |
before 0:2.5.10-2.el8ap | 0:2.5.10-2.el8ap |
automation-gateway-proxy-debugsourceRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 3 CVEs |
before 0:2.5.10-2.el8ap | 0:2.5.10-2.el8ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 3 CVEs |
before 0:2.5.10-2.el8ap | 0:2.5.10-2.el8ap |
automation-gateway-proxy-server-debuginfoRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 3 CVEs |
before 0:2.5.10-2.el8ap | 0:2.5.10-2.el8ap |
receptorRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 3 CVEs |
before 0:1.5.7-2.el8ap | 0:1.5.7-2.el8ap |
receptor-debuginfoRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 3 CVEs |
before 0:1.5.7-2.el8ap | 0:1.5.7-2.el8ap |
Show 28 moreShow less
| Package | Affected | Fixed |
|---|---|---|
receptor-debugsourceRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 3 CVEs |
before 0:1.5.7-2.el8ap | 0:1.5.7-2.el8ap |
receptorctlRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 3 CVEs |
before 0:1.5.7-2.el8ap | 0:1.5.7-2.el8ap |
receptorRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 3 CVEs |
before 0:1.5.7-2.el9ap | 0:1.5.7-2.el9ap |
receptorctlRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 3 CVEs |
before 0:1.5.7-2.el9ap | 0:1.5.7-2.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 3 CVEs |
before 0:1.5.7-2.el9ap | 0:1.5.7-2.el9ap |
receptorctlRed Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 3 CVEs |
before 0:1.5.7-2.el9ap | 0:1.5.7-2.el9ap |
automation-gateway-proxy-openssl30Red Hat:ansible_automation_platform:2.5::el9 From an advisory covering 3 CVEs |
before 0:2.6.6-2.el9ap | 0:2.6.6-2.el9ap |
automation-gateway-proxy-openssl30-debugsourceRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 3 CVEs |
before 0:2.6.6-2.el9ap | 0:2.6.6-2.el9ap |
automation-gateway-proxy-openssl30-serverRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 3 CVEs |
before 0:2.6.6-2.el9ap | 0:2.6.6-2.el9ap |
automation-gateway-proxy-openssl30-server-debuginfoRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 3 CVEs |
before 0:2.6.6-2.el9ap | 0:2.6.6-2.el9ap |
automation-gateway-proxy-openssl32Red Hat:ansible_automation_platform:2.5::el9 From an advisory covering 3 CVEs |
before 0:2.6.6-2.el9ap | 0:2.6.6-2.el9ap |
automation-gateway-proxy-openssl32-debugsourceRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 3 CVEs |
before 0:2.6.6-2.el9ap | 0:2.6.6-2.el9ap |
automation-gateway-proxy-openssl32-serverRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 3 CVEs |
before 0:2.6.6-2.el9ap | 0:2.6.6-2.el9ap |
automation-gateway-proxy-openssl32-server-debuginfoRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 3 CVEs |
before 0:2.6.6-2.el9ap | 0:2.6.6-2.el9ap |
receptorRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 3 CVEs |
before 0:1.5.7-2.el9ap | 0:1.5.7-2.el9ap |
receptor-debuginfoRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 3 CVEs |
before 0:1.5.7-2.el9ap | 0:1.5.7-2.el9ap |
receptor-debugsourceRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 3 CVEs |
before 0:1.5.7-2.el9ap | 0:1.5.7-2.el9ap |
receptorctlRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 3 CVEs |
before 0:1.5.7-2.el9ap | 0:1.5.7-2.el9ap |
automation-eda-controllerRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 3 CVEs |
before 0:1.1.11-1.el8ap | 0:1.1.11-1.el8ap |
automation-eda-controller-baseRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 3 CVEs |
before 0:1.1.11-1.el8ap | 0:1.1.11-1.el8ap |
automation-eda-controller-base-servicesRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 3 CVEs |
before 0:1.1.11-1.el8ap | 0:1.1.11-1.el8ap |
automation-eda-controller-event-stream-servicesRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 3 CVEs |
before 0:1.1.11-1.el8ap | 0:1.1.11-1.el8ap |
automation-eda-controller-worker-servicesRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 3 CVEs |
before 0:1.1.11-1.el8ap | 0:1.1.11-1.el8ap |
automation-eda-controllerRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 3 CVEs |
before 0:1.1.11-1.el9ap | 0:1.1.11-1.el9ap |
automation-eda-controller-baseRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 3 CVEs |
before 0:1.1.11-1.el9ap | 0:1.1.11-1.el9ap |
automation-eda-controller-base-servicesRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 3 CVEs |
before 0:1.1.11-1.el9ap | 0:1.1.11-1.el9ap |
automation-eda-controller-event-stream-servicesRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 3 CVEs |
before 0:1.1.11-1.el9ap | 0:1.1.11-1.el9ap |
automation-eda-controller-worker-servicesRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 3 CVEs |
before 0:1.1.11-1.el9ap | 0:1.1.11-1.el9ap |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| facts | CVE List, EUVD, NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-49521 is a high vulnerability (CVSS 8.8) in Red Hat Ansible Automation Platform 2.5 For Rhel 8, published June 30, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 48th percentile. No source names a fixed version.
References
access.redhat.com/errata/RHSA-2025:9986
bugzilla.redhat.com/show_bug.cgi?id=2370817
nvd.nist.gov/vuln/detail/CVE-2025-49521
github.com/advisories/GHSA-g6ph-9xfv-87c2
Show 15 moreShow less
issues.redhat.com/browse/AAP-42288
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9986.json
cve.org/CVERecord?id=CVE-2025-22871
go.dev/cl/652998
groups.google.com/g/golang-announce/c/Y2uBTVKjBQk
pkg.go.dev/vuln/GO-2025-3563