# Red Hat Ansible Automation Platform 2.5.

Every CVE that names Red Hat Ansible Automation Platform 2.5 among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Eda-server: websocket missing authorization allows credential theft via activation_id spoofing](https://agentprime.io/advisories/CVE-2026-11807.md)
  `CVE-2026-11807` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jun 2026 · Tags: Broken access control
- [Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions](https://agentprime.io/advisories/CVE-2025-57847.md)
  `CVE-2025-57847` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.16 and 4 more · CVSS 6.4 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Broken access control
- [Aap-gateway: improper path validation in gateway allows credential exfiltration](https://agentprime.io/advisories/CVE-2025-9909.md)
  `CVE-2025-9909` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 6.7 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: CWE-647
- [Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams](https://agentprime.io/advisories/CVE-2025-9908.md)
  `CVE-2025-9908` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 6.7 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Information disclosure
- [Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda](https://agentprime.io/advisories/CVE-2025-9907.md)
  `CVE-2025-9907` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 6.7 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Information disclosure
- [Ansible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictions](https://agentprime.io/advisories/CVE-2025-14025.md)
  `CVE-2025-14025` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 8.5 High · Not analysed yet · Published 8 Jan 2026 · Tags: CWE-279

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=red-hat-ansible-automation-platform-2-5>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/red-hat-ansible-automation-platform-2-5/>. Everything for agents: <https://agentprime.io/llms.txt>.