Database/Control plane, storage & DevOps
Ansible Automation Platform gateway: race in concurrent gRPC proxy requests can leak a higher-privileged user's JWT
Impact
Concurrent requests through the aap-gateway gRPC service race against each other, and a less privileged user can end up holding the JWT issued for a more privileged one. With that token the attacker inherits the other account's authority inside the automation platform - which, for a fleet driven by Ansible, means the ability to run playbooks against managed nodes with someone else's permissions. AAP is commonly the thing holding credentials for the whole estate, so a token leak at the gateway is an estate-wide credential problem rather than a single-service one. Confidential data in the affected sessions is also exposed.
Who can reach it
Any authenticated AAP user with low privileges who can send concurrent requests through the gateway. Network reachable; no administrative role required.
What to do
Apply RHSA-2025:1954 for Ansible Automation Platform 2.5 on RHEL 8 or 9 and restart the gateway service. The advisory does not name a mitigation for unpatched installs; limiting who holds any account on the gateway is the only interim reduction. Service restart only - no node reboot.
References
Related entries
- HPE Performance Cluster Manager (HPCM) GUI authentication bypass: Authentication bypass in the HPCM web GUICVE-2025-27086 · HPE Performance Cluster Manager (HPCM) GUI authentication bypassHigh
- HTCondor (IDToken authorization restrictions): The per-token authorization restrictions attached withCVE-2025-30093 · HTCondor (IDToken authorization restrictions)High
- ConnectWise ScreenConnect: ViewState code injectionCVE-2025-3935 · ConnectWise ScreenConnectHigh
- Coder: prebuilds system-user session token survives workspace claim and stays validCVE-2025-58437 · Coder (prebuilt workspace session token lifecycle)High
- MinIO (service accounts / STS session policies): The session policy attached to a service account or STS credential isCVE-2025-62506 · MinIO (service accounts / STS session policies)High
- Apache CloudStack: MinIO policies survive bucket deletion, giving a former owner access to a new bucket of the same nameCVE-2025-66467 · Apache CloudStack (MinIO object store policy cleanup on bucket deletion)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.