← Volver a CVEs
CVE-2025-14025
HIGH8.5
Descripcion
A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. However, this vulnerability allows read-only tokens to perform write operations on backend services (e.g., Controller, Hub, EDA). If this flaw were exploited, an attacker‘s capabilities would only be limited by role based access controls (RBAC).
Detalles CVE
Puntuacion CVSS v3.18.5
SeveridadHIGH
Vector CVSSCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Vector de ataqueNETWORK
ComplejidadHIGH
Privilegios requeridosLOW
Interaccion usuarioNONE
Publicado1/8/2026
Ultima modificacion1/8/2026
Fuentenvd
Avistamientos honeypot0
Debilidades (CWE)
CWE-279
Referencias
https://access.redhat.com/articles/7136004(secalert@redhat.com)
https://access.redhat.com/errata/RHSA-2026:0360(secalert@redhat.com)
https://access.redhat.com/errata/RHSA-2026:0361(secalert@redhat.com)
https://access.redhat.com/errata/RHSA-2026:0408(secalert@redhat.com)
https://access.redhat.com/errata/RHSA-2026:0409(secalert@redhat.com)
https://access.redhat.com/security/cve/CVE-2025-14025(secalert@redhat.com)
https://bugzilla.redhat.com/show_bug.cgi?id=2418785(secalert@redhat.com)
Correlaciones IOC
Sin correlaciones registradas
This product uses data from the NVD API but is not endorsed or certified by the NVD.