Cross-Site Request Forgery Flaw in Ansible AAP-Gateway
CVE-2025-5988

5.3MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Ansible Automation Platform 2.5 For Rhel 8
Red Hat Ansible Automation Platform 2.5 For Rhel 9
Vendor
CVE Published:
4 August 2025

What is CVE-2025-5988?

A vulnerability exists in the Ansible aap-gateway where cross-site request forgery checks are inadequately implemented. This oversight allows unauthorized requests to be sent from the gateway to external components, like the controller, hub, and event-driven automation (EDA) systems, potentially compromising the integrity of the application. It’s critical for organizations using Ansible to address this gap to ensure robust security against CSRF attacks.

Affected Version(s)

Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:2.5.20250730-2.el8ap

Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:2.5.20250730-2.el9ap

References

https://access.redhat.com/errata/RHSA-2025:12772
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-5988
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2371644
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered by Brennan Paciorek (Red Hat Inc.), Chris Meyers (Red Hat Inc.), Hao Liu (Red Hat Inc.), and Julen Landa Alustiza (Red Hat Inc.).
.
CVE-2025-5988 : Cross-Site Request Forgery Flaw in Ansible AAP-Gateway