---
id: CVE-2025-5988
title: 'Aap-gateway: csrf origin checking is disabled'
summary: >-
  A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF)
  origin checking is not done on requests from the gateway to external
  components, such as the controller, hub, and eda.
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-352
vendor: Red Hat
product: automation-gateway-server
affected:
  - automation-gateway-server < 2.5.20250730
  - automation-gateway (all versions)
  - automation-gateway (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-08-04T15:32:38.892622Z'
published: '2025-08-04'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T16:32:27.105Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-5988'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2025:12772'
    label: 'RHSA-2025:12772'
  - url: 'https://access.redhat.com/security/cve/CVE-2025-5988'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2371644'
    label: RHBZ#2371644
tags:
  - cve.org
epss: 0.00291
epssPercentile: 0.21758
ingestedAt: '2026-11-05T22:38:31.362Z'
---

## Overview

A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda.

## Affected

- `automation-gateway-server < 2.5.20250730`
- `automation-gateway (all versions)`
- `automation-gateway (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Use HTTPS on the platform ingress if possible.

Since this is a problem in edge-terminated AAP deployments where requests have TLS terminated right before the platform ingress, enforce trusted origins before requests reach the gateway.

A tool such as a Web-application firewall should be able to manage this issue.