Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 9 contains two security issues: CVE-2025-5988 where CSRF origin checking is disabled in the automation-gateway, potentially allowing cross-site request forgery attacks, and CVE-2025-7738 where sensitive authenticator secrets are exposed in clear text via the API in the python3.11-django-ansible-base component. Red Hat has issued a security advisory RHSA-2025:12772 that includes updated packages fixing these vulnerabilities along with other bug fixes and improvements. The automation-gateway and python3.11-django-ansible-base components have been updated to version 2.5.20250730. The advisory rates the security impact as moderate and provides updated RPM packages for affected architectures and RHEL versions.

The impact of CVE-2025-5988 is that disabling CSRF origin checking could allow an attacker to perform unauthorized actions via cross-site request forgery if a user is authenticated. CVE-2025-7738 could lead to exposure of sensitive authenticator secrets in clear text through the API, potentially compromising authentication credentials. Both vulnerabilities could undermine the security of automation workflows and credentials managed by the platform. The overall security impact is rated moderate by Red Hat.

Red Hat has released updated packages for the affected components as part of the Ansible Automation Platform 2.5.20250730 update and related component updates. Users should apply these official updates to remediate the vulnerabilities. The advisory does not indicate any temporary workarounds or that no action is required. Patch status is confirmed by the vendor advisory. Users should follow Red Hat's guidance to update automation-gateway and python3.11-django-ansible-base to the fixed versions. Other included bug fixes and improvements are also part of the update.