CVE-2025-48432VulnerabilityPublished 23 Sep 2025Updated 28 Jun 2026

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Affects Red HatSource GCVE Database

Mentioned vulnerabilities

CVE-2025-57833

Authoritative record:CVE-2025-48432· Medium 4.0

Not known to be exploited · CVSS 4.0 Medium · fixed in Red Hat package updates : update Red Hat django when convenient.

Data as of 26 Oct 2026, 10:12 UTC

CVSS 3.1 base score

4.0Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.7% chance of exploitation in 30 days – higher than 54% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 5.2.3, 5.1.11, 4.2.23

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Attack Vector: Network
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Changed
Confidentiality: None
Integrity: Low
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: High: A successful attack depends on conditions beyond the attacker's control. That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected. For example, a successful attack may require an attacker to: gather knowledge about the environment in which the vulnerable target/component exists; prepare the target environment to improve exploit reliability; or inject themselves into the logical network path between the target and the resource requested by the victim in order to read and/or modify network communications (e.g., a man in the middle attack).
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Changed: An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: Low: Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact on the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 5 Jun 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade django to 5.2.3, 5.1.11 or 4.2.23.

Affected software

Product	Affected	Fixed in
PyPIdjango`pkg:pypi/django`Other threats	Affected <4.2.23 <5.1.11 <5.2.3	Fixed in 4.2.23 5.1.11 5.2.3

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Red Hat has released updated packages that fix these vulnerabilities as part of the Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (automation-controller 4.6.20, automation-gateway 2.5.20250924, python3.11-django-ansible-base 2.5.20250924). Users should apply these official updates promptly to remediate the SQL injection and path injection vulnerabilities. Patch status is confirmed by the vendor advisory. No additional mitigations are specified beyond applying the provided updates.

Description

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: Django SQL injection in FilteredRelation column aliases (CVE-2025-57833) * automation-controller: Django Path Injection Vulnerability (CVE-2025-48432) * python3.11-django: Django SQL injection in FilteredRelation column aliases (CVE-2025-57833) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Updates and fixes included: Automation Platform * Increased gateway control plane authorization performance to reduce or eliminate sporadic request errors (503, 504, 403) (AAP-53468) * Fixed a bug where the gateway does not generate the necessary metadata for the UI to render "Settings" > "Platform Gateway" when the accessing user is an auditor rather than an admin (AAP-53279) * If the GRPC server can not connect to the database it will now return a 503 to envoy instead of a 403 (AAP-51931) * Altered the help text for the setting ALLOW_OAUTH2_FOR_EXTERNAL_USERS (AAP-51886) * Fixed improperly formatted error message in SAML authenticator when passing invalid security settings. The error will now properly show the invalid fields and will also indicate what valid field values are (AAP-51705) * Improved debug logging of authenticator map processing, reasoning and results for clarity (AAP-51639) * Fixed an issue with authenticator maps not properly evaluating attribute 'in' conditions (AAP-51638) * When logging in with SAML authentication, user's groups will be correctly read from configured attribute instead of expecting groups to always be in "Group" attribute (AAP-51503) * Added scrolling to multiselect dialogs to make pagination visible for users (AAP-52209) * Fixed an issue that did not allow a user to save Schedule for Workflow job template when Limit has Prompt on Launch was enabled (AAP-49794) * automation-gateway has been updated to 2.5.20250924 * python3.11-django-ansible-base has been updated to 2.5.20250924 Automation controller * Galaxy credentials can now be created and edited without the need to specify an organization (AAP-52197) * Fixed a path injection vulnerability in Django so that internal HTTP response logging escapes request.path and remote attackers can't manipulate log output via crafted URLs (AAP-51443) * The export command works through the controller collection or with awxkit along when the correct environment variable is provided (AAP-49452) * Fixed double escaped quotes in api/v2/jobs/{id}/stdout/?format=txt (AAP-49077) * The export module in the collection now honors the CONTROLLER_OPTIONAL_API_URLPATTERN_PREFIX environment variable, fixing a bug where exports did not work on deployments using the platform gateway (AAP-39265) * automation-controller has been updated to 4.6.20 Automation hub * Added the GALAXY_API_SPEC_REQUIRE_AUTHENTICATION setting (defaults to false), which restricts access to the OpenAPI specification to authenticated users only (AAP-53578) * automation-hub has been updated to 4.10.8 * python3.11-galaxy-ng has been updated to 4.10.8 Container-based Ansible Automation Platform * Disable IPv6 binding on PostgreSQL and Redis services when IPv6 is disabled on the host (AAP-53546) * Fixed the restore and implemented a migration for the controller resource secret key value (AAP-53535) * Uploading ansible collections to Private Automation Hub isn't limited by the API pagination anymore (AAP-53526) * Execute the create_initial_data EDA command during restore (AAP-53382) * Fix an issue with the Private Automation Hub task name using quotes (AAP-53307) * Fixed a path issue for custom_ca_cert when checking postgres connection and version during preflight (AAP-53213) * Fix PostgreSQL configuration directory creation when TLS is disabled (AAP-52569) * X-Forwarded-For and Real-Ip headers are now added to the Nginx logs (AAP-52562) * containerized installer setup has been updated to 2.5-19 RPM-based Ansible Automation Platform * Fixed an issue where redis_mode=standalone and the Redis group were defined at the same time (AAP-53560) * Fixed an issue with EDA restores where database credentials were not updated for event stream (AAP-53529) * Fixed an issue where redis node list could not be created on EDA/gateway nodes which were not part of the redis group (AAP-53528) * Fixed an issue where backup was failing when the deployment had more than 1 EDA node without eda_node_type defined (AAP-528

Impact

Successful exploitation of CVE-2025-57833 could allow SQL injection attacks via FilteredRelation column aliases, potentially leading to unauthorized data access or manipulation. CVE-2025-48432 could enable attackers to manipulate internal HTTP response logging by injecting crafted paths, possibly affecting log integrity and aiding further attacks. These vulnerabilities impact the automation-controller and related Django components within the Ansible Automation Platform 2.5. The overall security impact is rated as important/high by Red Hat.

Summary

This advisory addresses two security vulnerabilities in Red Hat Ansible Automation Platform 2.5: CVE-2025-57833, a Django SQL injection vulnerability in FilteredRelation column aliases affecting automation-controller and python3.11-django; and CVE-2025-48432, a Django path injection vulnerability in automation-controller that could allow remote attackers to manipulate HTTP response logging via crafted URLs. The update includes patches that fix these vulnerabilities and other bug fixes to improve platform stability and security. The advisory does not provide CVSS scores but rates the impact as important/high. The vendor has released updated packages for automation-controller (version 4.6.20), automation-gateway (2.5.20250924), python3.11-django-ansible-base (2.5.20250924), and other components.

CWE-117Improper Output Neutralization for Logs (opens in a new tab)
Base weaknessLikelihood of exploit: MediumOWASP Top 10 A09:2025: Security Logging & Alerting Failures (opens in a new tab)
The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Implementation · Output Encoding
Use and specify an output encoding that can be handled by the downstream component that is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8.
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
OWASP Cheat Sheets
Logging (opens in a new tab)
Content Security Policy (opens in a new tab)
Application Logging Vocabulary (opens in a new tab)
OWASP ASVS 4.0.3
V7.3.1 (opens in a new tab)
V14.4.6 (opens in a new tab)
V14.4.4 (opens in a new tab)
Attack patterns
Audit Log Manipulation (opens in a new tab)
Web Server Logs Tampering (opens in a new tab)
Log Injection-Tampering-Forging (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #2OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design · Parameterization
If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated.
Architecture and Design · Operation · Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment.
OWASP Cheat Sheets
Query Parameterization (opens in a new tab)
Unvalidated Redirects and Forwards (opens in a new tab)
XML Security (opens in a new tab)
XML External Entity Prevention (opens in a new tab)
File Upload (opens in a new tab)
OWASP ASVS 4.0.3
V5.3.4 (opens in a new tab)
V5.3.5 (opens in a new tab)
V1.5.1 (opens in a new tab)
Attack patterns
Command Line Execution through SQL Injection (opens in a new tab)
Object Relational Mapping Injection (opens in a new tab)
SQL Injection through SOAP Parameter Tampering (opens in a new tab)
Expanding Control over the Operating System from the Database (opens in a new tab)
SQL Injection (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 25 Jun 2026, 22:30 UTC

WeaknessesCWE-117, CWE-89

Technical details

References

Community reviews

Related threats