{"id":"CVE-2025-1801","aliases":["EUVD-2025-5589","GHSA-fj43-p45h-jjgv","RHSA-2025:1954"],"status":"published","title":"Aap-gateway: aap-gateway privilege escalation","description":"A flaw was found in the Ansible aap-gateway. Concurrent requests handled by the gateway grpc service can result in concurrency issues due to race condition requests against the proxy. This issue potentially allows a less privileged user to obtain the JWT of a greater privileged user, enabling the server to be jeopardized. A user session or confidential data might be vulnerable.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00327,"percentile":0.26022,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2025-03-02T10:01:30Z","modified":"2026-11-04T21:22:18Z","fixes":[{"ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway","fixed_in":["0:2.5.20250305-1.el8ap"],"sources":["osv"]},{"ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-config","fixed_in":["0:2.5.20250305-1.el8ap"],"sources":["osv"]},{"ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-server","fixed_in":["0:2.5.20250305-1.el8ap"],"sources":["osv"]},{"ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway","fixed_in":["0:2.5.20250305-1.el9ap"],"sources":["osv"]},{"ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-config","fixed_in":["0:2.5.20250305-1.el9ap"],"sources":["osv"]},{"ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-server","fixed_in":["0:2.5.20250305-1.el9ap"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20250305-1.el8ap"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20250305-1.el8ap"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20250305-1.el8ap"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20250305-1.el9ap"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20250305-1.el9ap"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20250305-1.el9ap"}]}]}],"products":[{"vendor":"red hat","product":"red hat ansible automation platform 2.5 for rhel 8"},{"vendor":"red hat","product":"red hat ansible automation platform 2.5 for rhel 9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:1954","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-1801","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2349081","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1801","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fj43-p45h-jjgv"},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1954.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-1801","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-1801","title":"Aap-gateway: aap-gateway privilege escalation","description":"A flaw was found in the Ansible aap-gateway. Concurrent requests handled by the gateway grpc service can result in concurrency issues due to race condition requests against the proxy. This issue potentially allows a less privileged user to obtain the JWT of a greater privileged user, enabling the server to be jeopardized. A user session or confidential data might be vulnerable.","status":"published","published":"2025-03-03T15:03:15.439Z","modified":"2026-11-04T21:22:18.82Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-362"],"updated_at":"2026-11-04T22:39:14.734949Z"}],"euvd":[{"id":"EUVD-2025-5589","description":"A flaw was found in the Ansible aap-gateway. Concurrent requests handled by the gateway grpc service can result in concurrency issues due to race condition requests against the proxy. This issue potentially allows a less privileged user to obtain the JWT of a greater privileged user, enabling the server to be jeopardized. A user session or confidential data might be vulnerable.","status":"published","published":"2025-03-03T15:03:15Z","modified":"2026-11-04T21:22:18Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-04T22:46:32.144626Z"}],"ghsa":[{"id":"GHSA-fj43-p45h-jjgv","title":"A flaw was found in the Ansible aap-gateway. Concurrent requests handled by the gateway grpc...","description":"A flaw was found in the Ansible aap-gateway. Concurrent requests handled by the gateway grpc service can result in concurrency issues due to race condition requests against the proxy. This issue potentially allows a less privileged user to obtain the JWT of a greater privileged user, enabling the server to be jeopardized. A user session or confidential data might be vulnerable.","status":"published","published":"2025-03-03T15:31:34Z","modified":"2025-03-03T15:32:56Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:00:07.317782Z"}],"nvd":[{"id":"CVE-2025-1801","description":"A flaw was found in the Ansible aap-gateway. Concurrent requests handled by the gateway grpc service can result in concurrency issues due to race condition requests against the proxy. This issue potentially allows a less privileged user to obtain the JWT of a greater privileged user, enabling the server to be jeopardized. A user session or confidential data might be vulnerable.","status":"published","published":"2025-03-03T15:15:16.5Z","modified":"2026-11-04T22:17:29.33Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-362"],"updated_at":"2026-11-04T23:43:37.864413Z"}],"osv":[{"id":"RHSA-2025:1954","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","status":"published","published":"2025-03-02T10:01:30Z","modified":"2026-03-18T11:37:10.062337Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"}]}}