CVE-2025-49521

Published: Jun 30, 2025Modified: Jun 17, 2026Deferred

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In OpenShift, it can lead to service account token theft.

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (3)

https://access.redhat.com/errata/RHSA-2025:9986

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2025-49521

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2370817

Source: secalert@redhat.com

Timeline

No history available yet.