A critical authorization flaw in Red Hat Ansible Automation Platform 2.5 allows authenticated users to perform unauthorized credential access and account takeover.

The /api/eda/ws/ansible-rulebook endpoint fails to perform proper permission checks on Worker messages. An authenticated user can leverage this to retrieve sensitive data, including OAuth tokens, vault passwords, and SSH keys.

With a CVSS score of 9.6, this vulnerability represents a severe threat to the integrity of automated workflows. Compromised credentials can facilitate lateral movement across the infrastructure, potentially leading to unauthorized control over the entire Ansible-managed environment and associated target systems.

Immediate Action: Update Red Hat Ansible Automation Platform 2.5 to the latest patched version provided by the vendor.

Proactive Monitoring: Audit access logs for the EDA websocket API to identify unusual activity or unauthorized requests targeting the /api/eda/ws/ansible-rulebook endpoint.

Compensating Controls: Limit access to the Ansible Automation Platform dashboard to strictly authorized personnel and implement network-level access controls to minimize the attack surface.

Public Exploit Available: False

Given the potential for complete credential exposure, organizations utilizing Red Hat Ansible Automation Platform 2.5 must apply the necessary updates immediately. Failure to patch could result in widespread unauthorized access to sensitive automation secrets and infrastructure control.