CVE-2025-14025

Ansible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictions

State: Published
Severity: 8.5 High
Published: Jan 8, 2026
Updated: Feb 26, 2026
Reserved: Dec 4, 2025

Description

A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. However, this vulnerability allows read-only tokens to perform write operations on backend services (e.g., Controller, Hub, EDA). If this flaw were exploited, an attacker‘s capabilities would only be limited by role based access controls (RBAC).

Scores

CVSS	Score	Vector	Source
3.1	8.5 High	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H	redhat

Weaknesses

CWE-279 Incorrect Execution-Assigned Permissions

Affected Products

Product	Versions
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:2.5.20260106-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:2.5.20260106-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.6 for RHEL 9Red Hat	0:2.6.20260106-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5Red Hat	sha256:2df290b61d7aac08deec2973d0a9b98788f6b619e974af0b3f4b61c759c7e464 and laterNot affected
Red Hat Ansible Automation Platform 2.6Red Hat	sha256:766c7570afc4e9b163a3256a0d7c699327905c1d24213229acb0b96a9e65b615 and laterNot affected

References

https://access.redhat.com/articles/7136004
RHSA-2026:0360vendor-advisory
RHSA-2026:0361vendor-advisory
RHSA-2026:0408vendor-advisory
RHSA-2026:0409vendor-advisory
https://access.redhat.com/security/cve/CVE-2025-14025vdb-entry
RHBZ#2418785issue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.