Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: Django SQL injection in FilteredRelation column aliases (CVE-2025-57833) * automation-controller: Django Path Injection Vulnerability (CVE-2025-48432) * python3.11-django: Django SQL injection in FilteredRelation column aliases (CVE-2025-57833) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Updates and fixes included: Automation Platform * Increased gateway control plane authorization performance to reduce or eliminate sporadic request errors (503, 504, 403) (AAP-53468) * Fixed a bug where the gateway does not generate the necessary metadata for the UI to render "Settings" > "Platform Gateway" when the accessing user is an auditor rather than an admin (AAP-53279) * If the GRPC server can not connect to the database it will now return a 503 to envoy instead of a 403 (AAP-51931) * Altered the help text for the setting ALLOW_OAUTH2_FOR_EXTERNAL_USERS (AAP-51886) * Fixed improperly formatted error message in SAML authenticator when passing invalid security settings. The error will now properly show the invalid fields and will also indicate what valid field values are (AAP-51705) * Improved debug logging of authenticator map processing, reasoning and results for clarity (AAP-51639) * Fixed an issue with authenticator maps not properly evaluating attribute 'in' conditions (AAP-51638) * When logging in with SAML authentication, user's groups will be correctly read from configured attribute instead of expecting groups to always be in "Group" attribute (AAP-51503) * Added scrolling to multiselect dialogs to make pagination visible for users (AAP-52209) * Fixed an issue that did not allow a user to save Schedule for Workflow job template when Limit has Prompt on Launch was enabled (AAP-49794) * automation-gateway has been updated to 2.5.20250924 * python3.11-django-ansible-base has been updated to 2.5.20250924 Automation controller * Galaxy credentials can now be created and edited without the need to specify an organization (AAP-52197) * Fixed a path injection vulnerability in Django so that internal HTTP response logging escapes request.path and remote attackers can't manipulate log output via crafted URLs (AAP-51443) * The export command works through the controller collection or with awxkit along when the correct environment variable is provided (AAP-49452) * Fixed double escaped quotes in api/v2/jobs/{id}/stdout/?format=txt (AAP-49077) * The export module in the collection now honors the CONTROLLER_OPTIONAL_API_URLPATTERN_PREFIX environment variable, fixing a bug where exports did not work on deployments using the platform gateway (AAP-39265) * automation-controller has been updated to 4.6.20 Automation hub * Added the GALAXY_API_SPEC_REQUIRE_AUTHENTICATION setting (defaults to false), which restricts access to the OpenAPI specification to authenticated users only (AAP-53578) * automation-hub has been updated to 4.10.8 * python3.11-galaxy-ng has been updated to 4.10.8 Container-based Ansible Automation Platform * Disable IPv6 binding on PostgreSQL and Redis services when IPv6 is disabled on the host (AAP-53546) * Fixed the restore and implemented a migration for the controller resource secret key value (AAP-53535) * Uploading ansible collections to Private Automation Hub isn't limited by the API pagination anymore (AAP-53526) * Execute the create_initial_data EDA command during restore (AAP-53382) * Fix an issue with the Private Automation Hub task name using quotes (AAP-53307) * Fixed a path issue for custom_ca_cert when checking postgres connection and version during preflight (AAP-53213) * Fix PostgreSQL configuration directory creation when TLS is disabled (AAP-52569) * X-Forwarded-For and Real-Ip headers are now added to the Nginx logs (AAP-52562) * containerized installer setup has been updated to 2.5-19 RPM-based Ansible Automation Platform * Fixed an issue where redis_mode=standalone and the Redis group were defined at the same time (AAP-53560) * Fixed an issue with EDA restores where database credentials were not updated for event stream (AAP-53529) * Fixed an issue where redis node list could not be created on EDA/gateway nodes which were not part of the redis group (AAP-53528) * Fixed an issue where backup was failing when the deployment had more than 1 EDA node without eda_node_type defined (AAP-528
AI Analysis
Technical Summary
This advisory addresses two security vulnerabilities in Red Hat Ansible Automation Platform 2.5: CVE-2025-57833, a Django SQL injection vulnerability in FilteredRelation column aliases affecting automation-controller and python3.11-django; and CVE-2025-48432, a Django path injection vulnerability in automation-controller that could allow remote attackers to manipulate HTTP response logging via crafted URLs. The update includes patches that fix these vulnerabilities and other bug fixes to improve platform stability and security. The advisory does not provide CVSS scores but rates the impact as important/high. The vendor has released updated packages for automation-controller (version 4.6.20), automation-gateway (2.5.20250924), python3.11-django-ansible-base (2.5.20250924), and other components.
Potential Impact
Successful exploitation of CVE-2025-57833 could allow SQL injection attacks via FilteredRelation column aliases, potentially leading to unauthorized data access or manipulation. CVE-2025-48432 could enable attackers to manipulate internal HTTP response logging by injecting crafted paths, possibly affecting log integrity and aiding further attacks. These vulnerabilities impact the automation-controller and related Django components within the Ansible Automation Platform 2.5. The overall security impact is rated as important/high by Red Hat.
Mitigation Recommendations
Red Hat has released updated packages that fix these vulnerabilities as part of the Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (automation-controller 4.6.20, automation-gateway 2.5.20250924, python3.11-django-ansible-base 2.5.20250924). Users should apply these official updates promptly to remediate the SQL injection and path injection vulnerabilities. Patch status is confirmed by the vendor advisory. No additional mitigations are specified beyond applying the provided updates.
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
Description
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: Django SQL injection in FilteredRelation column aliases (CVE-2025-57833) * automation-controller: Django Path Injection Vulnerability (CVE-2025-48432) * python3.11-django: Django SQL injection in FilteredRelation column aliases (CVE-2025-57833) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Updates and fixes included: Automation Platform * Increased gateway control plane authorization performance to reduce or eliminate sporadic request errors (503, 504, 403) (AAP-53468) * Fixed a bug where the gateway does not generate the necessary metadata for the UI to render "Settings" > "Platform Gateway" when the accessing user is an auditor rather than an admin (AAP-53279) * If the GRPC server can not connect to the database it will now return a 503 to envoy instead of a 403 (AAP-51931) * Altered the help text for the setting ALLOW_OAUTH2_FOR_EXTERNAL_USERS (AAP-51886) * Fixed improperly formatted error message in SAML authenticator when passing invalid security settings. The error will now properly show the invalid fields and will also indicate what valid field values are (AAP-51705) * Improved debug logging of authenticator map processing, reasoning and results for clarity (AAP-51639) * Fixed an issue with authenticator maps not properly evaluating attribute 'in' conditions (AAP-51638) * When logging in with SAML authentication, user's groups will be correctly read from configured attribute instead of expecting groups to always be in "Group" attribute (AAP-51503) * Added scrolling to multiselect dialogs to make pagination visible for users (AAP-52209) * Fixed an issue that did not allow a user to save Schedule for Workflow job template when Limit has Prompt on Launch was enabled (AAP-49794) * automation-gateway has been updated to 2.5.20250924 * python3.11-django-ansible-base has been updated to 2.5.20250924 Automation controller * Galaxy credentials can now be created and edited without the need to specify an organization (AAP-52197) * Fixed a path injection vulnerability in Django so that internal HTTP response logging escapes request.path and remote attackers can't manipulate log output via crafted URLs (AAP-51443) * The export command works through the controller collection or with awxkit along when the correct environment variable is provided (AAP-49452) * Fixed double escaped quotes in api/v2/jobs/{id}/stdout/?format=txt (AAP-49077) * The export module in the collection now honors the CONTROLLER_OPTIONAL_API_URLPATTERN_PREFIX environment variable, fixing a bug where exports did not work on deployments using the platform gateway (AAP-39265) * automation-controller has been updated to 4.6.20 Automation hub * Added the GALAXY_API_SPEC_REQUIRE_AUTHENTICATION setting (defaults to false), which restricts access to the OpenAPI specification to authenticated users only (AAP-53578) * automation-hub has been updated to 4.10.8 * python3.11-galaxy-ng has been updated to 4.10.8 Container-based Ansible Automation Platform * Disable IPv6 binding on PostgreSQL and Redis services when IPv6 is disabled on the host (AAP-53546) * Fixed the restore and implemented a migration for the controller resource secret key value (AAP-53535) * Uploading ansible collections to Private Automation Hub isn't limited by the API pagination anymore (AAP-53526) * Execute the create_initial_data EDA command during restore (AAP-53382) * Fix an issue with the Private Automation Hub task name using quotes (AAP-53307) * Fixed a path issue for custom_ca_cert when checking postgres connection and version during preflight (AAP-53213) * Fix PostgreSQL configuration directory creation when TLS is disabled (AAP-52569) * X-Forwarded-For and Real-Ip headers are now added to the Nginx logs (AAP-52562) * containerized installer setup has been updated to 2.5-19 RPM-based Ansible Automation Platform * Fixed an issue where redis_mode=standalone and the Redis group were defined at the same time (AAP-53560) * Fixed an issue with EDA restores where database credentials were not updated for event stream (AAP-53529) * Fixed an issue where redis node list could not be created on EDA/gateway nodes which were not part of the redis group (AAP-53528) * Fixed an issue where backup was failing when the deployment had more than 1 EDA node without eda_node_type defined (AAP-528
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory addresses two security vulnerabilities in Red Hat Ansible Automation Platform 2.5: CVE-2025-57833, a Django SQL injection vulnerability in FilteredRelation column aliases affecting automation-controller and python3.11-django; and CVE-2025-48432, a Django path injection vulnerability in automation-controller that could allow remote attackers to manipulate HTTP response logging via crafted URLs. The update includes patches that fix these vulnerabilities and other bug fixes to improve platform stability and security. The advisory does not provide CVSS scores but rates the impact as important/high. The vendor has released updated packages for automation-controller (version 4.6.20), automation-gateway (2.5.20250924), python3.11-django-ansible-base (2.5.20250924), and other components.
Potential Impact
Successful exploitation of CVE-2025-57833 could allow SQL injection attacks via FilteredRelation column aliases, potentially leading to unauthorized data access or manipulation. CVE-2025-48432 could enable attackers to manipulate internal HTTP response logging by injecting crafted paths, possibly affecting log integrity and aiding further attacks. These vulnerabilities impact the automation-controller and related Django components within the Ansible Automation Platform 2.5. The overall security impact is rated as important/high by Red Hat.
Mitigation Recommendations
Red Hat has released updated packages that fix these vulnerabilities as part of the Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (automation-controller 4.6.20, automation-gateway 2.5.20250924, python3.11-django-ansible-base 2.5.20250924). Users should apply these official updates promptly to remediate the SQL injection and path injection vulnerabilities. Patch status is confirmed by the vendor advisory. No additional mitigations are specified beyond applying the provided updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:16487
- Cve Count
- 2
- Additional Cves
- ["CVE-2025-57833"]
Threat ID: 6a3da1e24853345fc182c8bf
Added to database: 06/25/2026, 21:47:14 UTC
Last enriched: 06/25/2026, 22:30:12 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 95
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.