CVE-2025-5988 | THREATINT

Description

A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda.

Reserved 2025-06-11 | Published 2025-08-04 | Updated 2025-08-04 | Assigner redhat

MEDIUM: 5.3CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Problem types

Cross-Site Request Forgery (CSRF)

Product status

Default status

unknown

Timeline

2025-06-11:	Reported to Red Hat.
2025-08-04:	Made public.

Credits

This issue was discovered by Brennan Paciorek (Red Hat Inc.), Chris Meyers (Red Hat Inc.), Hao Liu (Red Hat Inc.), and Julen Landa Alustiza (Red Hat Inc.).

References

access.redhat.com/security/cve/CVE-2025-5988 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2371644 (RHBZ#2371644) issue-tracking

cve.org (CVE-2025-5988)

nvd.nist.gov (CVE-2025-5988)

Download JSON