The advisory concerns a SQL injection vulnerability (CVE-2025-59681) found in Django, specifically in QuerySet methods such as annotate(), alias(), aggregate(), and extra() when used with MySQL and MariaDB databases. This flaw allows injection via column aliases using crafted dictionaries, enabling attackers to execute unauthorized SQL commands, read sensitive data, bypass authentication and authorization, and modify application data. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-22. Red Hat has released an update to the Ansible dev-tools to version 2.6 and expanded architecture support but has not provided a direct fix for the underlying SQL injection issue. The advisory notes that mitigation options are either unavailable or unsuitable for widespread deployment. The affected product is Red Hat Ansible Automation Platform 2.6, with versions >=2.6 and <2.7 impacted. The advisory includes references to related CVEs and detailed technical and impact information.

Successful exploitation of the SQL injection vulnerability could allow attackers to execute arbitrary SQL commands, potentially leading to unauthorized code execution, disclosure of sensitive application data, bypassing authentication mechanisms, privilege escalation, and unauthorized modification or deletion of data. This poses a high risk to confidentiality, integrity, and authentication controls within affected environments. The vulnerability affects database-backed operations in Django used by the Ansible Automation Platform, impacting the security of automation workflows and potentially the underlying infrastructure managed by Ansible.

Red Hat has not provided an official fix for the SQL injection vulnerability at this time. Mitigation options are either unavailable or do not meet Red Hat's criteria for ease of use, applicability, or stability. Users are advised to apply all previously released errata relevant to their systems and monitor Red Hat advisories for updates. Customers with a Technical Account Manager (TAM) can consult directly for tailored guidance. Upgrading to a future supported version that includes a fix, once available, is recommended. Until a fix is released, cautious use of affected QuerySet methods and limiting exposure of vulnerable components may reduce risk.