Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * ansible-core: Unsafe Tagging Bypass via hostvars Object in Ansible-Core (CVE-2024-11079) * automation-gateway: Improper Scope Handling in OAuth2 Tokens for AAP 2.5 (CVE-2024-11483) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Updates and fixes included: Automation Platform UI * Added support for filtering job templates, jobs, and inventories by labels (AAP-36540) * Fixed an issue where it was not possible to open a job template after removing the user which created the template (AAP-35820) * Fixed an issue where the inventory source update failed, and did not allow selection of the inventory file (AAP-35246) * Fixed an issue where the Login Redirect Override setting was missing and not functioning as expected (AAP-33295) * Disabled auto complete for secret credential fields (AAP-33188) * Fixed an issue where users were able to select a credential that required a password when defining a schedule (AAP-32821) * Fixed the navigation Team -> roles -> eda to the created team role page, where it did not work after adding a new team role.(AAP-31873) * When configuring an Ansible Remote to sync collections from other servers, a requirements file is only required for syncs from Galaxy, and optional otherwise. Without a requirements file, all collections get synced (AAP-31238) * Fixed an issue where the job output did not show unless you switched tabs (AAP-31125) * Fixed an issue where the bulk removal of selected role permissions disappeared when more than 4 permissions were selected (AAP-28030) Event-Driven Ansible * Fixed an issue where the project sync would not fail on an empty or unstructured git repository (AAP-35777) * Fixed an issue in the collection where the activation module failed with a misleading error message if the rulebook, project, decision environment, or organization could not be found (AAP-35360) * Fixed an issue where rulebook validation import/sync fails when a rulebook has a duplicated rule name (AAP-35164) * Added validation that a host specified as part of a container registry credential conforms to container registry standards (AAP-34969) * Fixed an issue where the Event Driven Ansible API allowed a credential’s type to be changed (AAP-34968) * Fixed an issue where a previously failed project could be accidentally changed to completed after a resync (AAP-34744) * Fixed an issue where no message was recorded when a project did not contain any rulebooks (AAP-34555) * Fixed an issue whereby multiple Red Hat Ansible Automation Platform credentials were being attached to activations (AAP-34025) * Fixed an issue where the url field of the event stream was not updated if EDA_EVENT_STREAM_BASE_URL setting changed (AAP-33819) * Extended the scope of the log_level and debug settings (AAP-33669) * Fixed an issue where there was an erroneous dependency on the existence of an organization named Default (AAP-33551) * A project can now be synced with the Event Driven Ansible collection modules (AAP-32264) * Fixed an issue where occasionally an activation is reported as running, before it is ready to receive events (AAP-31225) * Fixed an issue where Enabled options had its own scrollbar on the Rulebook Activation Details page (AAP-31130) * Added 'purge_log_records' to aap-eda-manage to clean up outdated database records (AAP-30684) * Fixed an issue where the status of an activation was occasionally inconsistent with the status of the latest instance after a restart (AAP-29755) * Fixed an issue where the user could not edit auto-generated injector vars while creating Event Driven Ansible custom credentials (AAP-29752) * Fixed an issue where importing a project from a non-existing branch resulted in the completed state instead of a Failed status (AAP-29144) * Fixed an issue where in some cases the file_watch source plugin in an Event Driven Ansible collection raised the QueueFull exception (AAP-29139) * In the Rulebook activation create form, selecting a project is now required before selecting a rulebook (AAP-28082) * The Create Credentials button is now visible irrespective of whether there are any existing credentials or not (AAP-23707) * automation-eda-controller has been updated to 1.1.3 * ansible-rulebook has been updated to 1.1.2 Container-based Ansible Automation Platform * Fixed an issue that allowed Automation controll
AI Analysis
Technical Summary
This advisory addresses two security vulnerabilities in Red Hat Ansible Automation Platform 2.5. The first, CVE-2024-11079, is an unsafe tagging bypass via the hostvars object in ansible-core, potentially allowing unauthorized access or privilege escalation within automation tasks. The second, CVE-2024-11483, involves improper scope handling in OAuth2 tokens in the automation-gateway, which could lead to unauthorized token usage. Red Hat has issued an update that includes fixes for these vulnerabilities along with multiple bug fixes and feature improvements. The advisory rates the security impact as moderate and provides an updated package for Red Hat Ansible Automation Platform 2.5 for RHEL 8.
Potential Impact
The vulnerabilities could allow attackers to bypass tagging restrictions in ansible-core or misuse OAuth2 tokens due to improper scope handling, potentially leading to unauthorized actions within the automation platform. This may affect the integrity and security of automated IT operations managed by the platform. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released an official security update for Ansible Automation Platform 2.5 that addresses these vulnerabilities. Users should apply the update as provided in Red Hat Security Advisory RHSA-2024:11145 to remediate these issues. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated beyond applying the official update.
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
Description
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * ansible-core: Unsafe Tagging Bypass via hostvars Object in Ansible-Core (CVE-2024-11079) * automation-gateway: Improper Scope Handling in OAuth2 Tokens for AAP 2.5 (CVE-2024-11483) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Updates and fixes included: Automation Platform UI * Added support for filtering job templates, jobs, and inventories by labels (AAP-36540) * Fixed an issue where it was not possible to open a job template after removing the user which created the template (AAP-35820) * Fixed an issue where the inventory source update failed, and did not allow selection of the inventory file (AAP-35246) * Fixed an issue where the Login Redirect Override setting was missing and not functioning as expected (AAP-33295) * Disabled auto complete for secret credential fields (AAP-33188) * Fixed an issue where users were able to select a credential that required a password when defining a schedule (AAP-32821) * Fixed the navigation Team -> roles -> eda to the created team role page, where it did not work after adding a new team role.(AAP-31873) * When configuring an Ansible Remote to sync collections from other servers, a requirements file is only required for syncs from Galaxy, and optional otherwise. Without a requirements file, all collections get synced (AAP-31238) * Fixed an issue where the job output did not show unless you switched tabs (AAP-31125) * Fixed an issue where the bulk removal of selected role permissions disappeared when more than 4 permissions were selected (AAP-28030) Event-Driven Ansible * Fixed an issue where the project sync would not fail on an empty or unstructured git repository (AAP-35777) * Fixed an issue in the collection where the activation module failed with a misleading error message if the rulebook, project, decision environment, or organization could not be found (AAP-35360) * Fixed an issue where rulebook validation import/sync fails when a rulebook has a duplicated rule name (AAP-35164) * Added validation that a host specified as part of a container registry credential conforms to container registry standards (AAP-34969) * Fixed an issue where the Event Driven Ansible API allowed a credential’s type to be changed (AAP-34968) * Fixed an issue where a previously failed project could be accidentally changed to completed after a resync (AAP-34744) * Fixed an issue where no message was recorded when a project did not contain any rulebooks (AAP-34555) * Fixed an issue whereby multiple Red Hat Ansible Automation Platform credentials were being attached to activations (AAP-34025) * Fixed an issue where the url field of the event stream was not updated if EDA_EVENT_STREAM_BASE_URL setting changed (AAP-33819) * Extended the scope of the log_level and debug settings (AAP-33669) * Fixed an issue where there was an erroneous dependency on the existence of an organization named Default (AAP-33551) * A project can now be synced with the Event Driven Ansible collection modules (AAP-32264) * Fixed an issue where occasionally an activation is reported as running, before it is ready to receive events (AAP-31225) * Fixed an issue where Enabled options had its own scrollbar on the Rulebook Activation Details page (AAP-31130) * Added 'purge_log_records' to aap-eda-manage to clean up outdated database records (AAP-30684) * Fixed an issue where the status of an activation was occasionally inconsistent with the status of the latest instance after a restart (AAP-29755) * Fixed an issue where the user could not edit auto-generated injector vars while creating Event Driven Ansible custom credentials (AAP-29752) * Fixed an issue where importing a project from a non-existing branch resulted in the completed state instead of a Failed status (AAP-29144) * Fixed an issue where in some cases the file_watch source plugin in an Event Driven Ansible collection raised the QueueFull exception (AAP-29139) * In the Rulebook activation create form, selecting a project is now required before selecting a rulebook (AAP-28082) * The Create Credentials button is now visible irrespective of whether there are any existing credentials or not (AAP-23707) * automation-eda-controller has been updated to 1.1.3 * ansible-rulebook has been updated to 1.1.2 Container-based Ansible Automation Platform * Fixed an issue that allowed Automation controll
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory addresses two security vulnerabilities in Red Hat Ansible Automation Platform 2.5. The first, CVE-2024-11079, is an unsafe tagging bypass via the hostvars object in ansible-core, potentially allowing unauthorized access or privilege escalation within automation tasks. The second, CVE-2024-11483, involves improper scope handling in OAuth2 tokens in the automation-gateway, which could lead to unauthorized token usage. Red Hat has issued an update that includes fixes for these vulnerabilities along with multiple bug fixes and feature improvements. The advisory rates the security impact as moderate and provides an updated package for Red Hat Ansible Automation Platform 2.5 for RHEL 8.
Potential Impact
The vulnerabilities could allow attackers to bypass tagging restrictions in ansible-core or misuse OAuth2 tokens due to improper scope handling, potentially leading to unauthorized actions within the automation platform. This may affect the integrity and security of automated IT operations managed by the platform. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released an official security update for Ansible Automation Platform 2.5 that addresses these vulnerabilities. Users should apply the update as provided in Red Hat Security Advisory RHSA-2024:11145 to remediate these issues. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated beyond applying the official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2024:11145
- Cve Count
- 2
- Additional Cves
- ["CVE-2024-11483"]
Threat ID: 6a1f4e8be29bf47b50084836
Added to database: 06/02/2026, 21:43:39 UTC
Last enriched: 06/26/2026, 02:18:56 UTC
Last updated: 09/10/2026, 19:36:47 UTC
Views: 254
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.