Red Hat released a security advisory (RHSA-2024:11145) for Ansible Automation Platform 2.5 addressing two moderate severity vulnerabilities: CVE-2024-11079, an unsafe tagging bypass via the hostvars object in ansible-core, and CVE-2024-11483, improper scope handling in OAuth2 tokens within the automation gateway. The update includes fixes that prevent unauthorized bypass of tagging controls and correct OAuth2 token scope validation. Additionally, the advisory details multiple bug fixes and feature enhancements across the platform's UI, Event-Driven Ansible, and containerized environments. The vendor rates the security impact as moderate and provides an official patch in this update.

The vulnerabilities could allow attackers to bypass tagging restrictions via the hostvars object or exploit improper OAuth2 token scope handling, potentially leading to unauthorized actions within the Ansible Automation Platform environment. The overall security impact is rated moderate by Red Hat. No known exploits in the wild have been reported at the time of this advisory.

An official security update for Red Hat Ansible Automation Platform 2.5 has been released addressing these vulnerabilities. Users should apply the update provided in RHSA-2024:11145 to remediate the unsafe tagging bypass and OAuth2 token scope issues. No additional mitigation steps are indicated by the vendor advisory beyond applying the update.