Skip to main content

Ansible Automation Platform EUVDEUVD-2025-21135

| CVE-2025-53862 LOW
Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)
2025-07-11 secalert@redhat.com
Information Disclosure Red Hat Ansible Automation Platform
3.5
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-497
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
Impact

CVSS 3.5. EPSS 0.0%. No patch confirmed.
Exploit ScenarioDerived

An attacker could exploit this vulnerability in A flaw to compromise the security of affected deployments, potentially impacting confidentiality, integrity, or availability.
Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).
No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 16, 2026

A security vulnerability in A flaw (CVSS 3.5) that allows a malicious user. Remediation should follow standard vulnerability management procedures.

Earlier versions of this analysis (1)
v1 Mar 16, 2026 - 08:17 CVSS 3.5

A flaw was found in Ansible. Three API endpoints are accessible and return verbose, unauthenticated responses. This flaw allows a malicious user to access data that may contain important information.

RemediationAI

Monitor vendor channels for patch availability.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Vulnerability type not specified by vendor. Affects A flaw.

Know when Ansible Automation Platform gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 3.5 LOW
AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

DescriptionCVE.org

A flaw was found in Ansible. Three API endpoints are accessible and return verbose, unauthenticated responses. This flaw allows a malicious user to access data that may contain important information.

Executive ViewAI

Why It Matters

CVE-2025-53862 is a low-severity vulnerability in A flaw (CVSS 3.5). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.

Business Impact: Low
Compensating Controls

Apply vendor patch during routine maintenance. Standard security controls provide adequate interim protection.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity LOW
CISA KEV No
Public POC No
EPSS 0.0%
Patch available No
Active threat No
Deciding rule
LOW severity (CVSS 0.1-3.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Controlled
Automatable· derived
No
Human Impact
Low

Priority Score

18
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +18
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)CVE.org

cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:*

More in Ansible Automation Platform

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2023-5189 MEDIUM POC
6.5 Nov 14

A path traversal vulnerability exists in Ansible when extracting tarballs. Rated medium severity (CVSS 6.5), this vulner
CVE-2022-2568 MEDIUM POC
6.5 Aug 18

A privilege escalation flaw was found in the Ansible Automation Platform. Rated medium severity (CVSS 6.5), this vulnera
CVE-2022-3644 MEDIUM POC
5.5 Oct 25

The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes th
CVE-2023-5764 HIGH
7.8 Dec 12

A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the u
CVE-2023-4237 HIGH
7.8 Oct 04

A flaw was found in the Ansible Automation Platform. Rated high severity (CVSS 7.8), this vulnerability is low attack co
CVE-2023-50782 HIGH
7.5 Feb 05

A flaw was found in the python-cryptography package. Rated high severity (CVSS 7.5), this vulnerability is remotely expl
CVE-2021-20228 HIGH
7.5 Apr 29

A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the
CVE-2021-3583 HIGH
7.1 Sep 22

A flaw was found in Ansible, where a user's controller is vulnerable to template injection. Rated high severity (CVSS 7.
CVE-2022-1632 MEDIUM
6.5 Sep 01

An Improper Certificate Validation attack was found in Openshift. Rated medium severity (CVSS 6.5), this vulnerability i
CVE-2023-5115 MEDIUM
6.3 Dec 18

An absolute path traversal attack exists in the Ansible automation platform. Rated medium severity (CVSS 6.3), this vuln
CVE-2023-4380 MEDIUM
6.3 Oct 04

A logic flaw exists in Ansible Automation platform. Rated medium severity (CVSS 6.3), this vulnerability is remotely exp

Same weakness CWE-497 – Exposure of Sensitive System Information to an Unauthorized Control Sphere

View all
CVE-2026-34413 HIGH POC
8.8
CVE-2026-41459 MEDIUM POC
6.9
CVE-2025-44823 HIGH POC
8.8
CVE-2022-1902 HIGH POC
8.8
CVE-2022-4985 HIGH POC
8.7
CVE-2018-25358 HIGH POC
8.7
CVE-2020-36922 HIGH POC
7.5
CVE-2020-36926 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

References

Advisories & patches
ADVISORY https://access.redhat.com/security/cve/CVE-2025-53862 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-53862 REF https://bugzilla.redhat.com/show_bug.cgi?id=2379359

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy