Dashboard / CVE-2025-5988

CVE-2025-5988

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 51/100
Published: 2025-08-04 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Network No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: Low
UI: None
S: Unchanged
C: High
I: None
A: None

Description

A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
— — 0 < 2.5.20250730

References & Advisories (3)

https://access.redhat.com/errata/RHSA-2025:12772
vendor-advisory x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2371644
issue-tracking x_refsource_REDHAT

Bug Bounty Relevance

51 / 100
✓ Network accessible
✓ No user interaction

CVSS Score

5.3 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploitation Probability

0.29%
Raw Score 0.002910
Percentile 21.9%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00291
2026-11-13
0.00291
2026-11-12
0.00291
2026-11-10
0.00291
2026-11-09
0.00291
2026-11-08
0.00291
2026-11-07
0.00291
2026-11-06
0.00291
2026-11-05
0.00291

Intelligence Sources

mitre ref →
nvd ref →

External Links