---
id: CVE-2025-49521
title: >-
  A flaw was found in the EDA component of the Ansible Automation Platform,
  where user-supplied Git branch or refspec values are evaluated as Jinja2
  templates
summary: >-
  A flaw was found in the EDA component of the Ansible Automation Platform,
  where user-supplied Git branch or refspec values are evaluated as Jinja2
  templates. This vulnerability allows authenticated users to inject expressions
  that execut…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-94
vendor: Red Hat
product: automation-eda-controller
affected:
  - automation-eda-controller (all versions)
  - automation-eda-controller (all versions)
published: '2025-06-30'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T13:17:16.663'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-49521'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2025:9986'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2025-49521'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2370817'
    label: secalert@redhat.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-07-01T00:00:00+00:00'
epss: 0.00599
epssPercentile: 0.48793
ingestedAt: '2026-11-05T06:38:03.599Z'
---

## Overview

A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In OpenShift, it can lead to service account token theft.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.