High · CVSS 8.1CVE-2025-1801

Aap-gateway: aap-gateway privilege escalationCVE-2025-1801

Answer in brief

CVE-2025-1801 records a High severity (CVSS 8.1) vulnerability in Aap-gateway: aap-gateway privilege escalation. The current sources do not mark it as known exploited. The current feed maps automation-gateway (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Mar 3, 2025Updated Nov 4, 2026Source checked Nov 4, 2026First seen by HOL Nov 4, 2026Material review Nov 4, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 8.1
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Available

Why this deserves its current priority

CVSS is 8.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps automation-gateway (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
automation-gatewaygeneric	>=2.5.0 <2.5.20250305-1	2.5.20250305-1

Recommended response

Check inventory. Check lockfiles and deployed manifests for automation-gateway.
Review the reported fix. Source-reported workaround: Follow the mitigation steps to avoid the flaw from happening. It is recommended to update the product after the fix is available. 1) set GRPC_SERVER_MAX_THREADS_PER_PROCESS = 1 This mitigates problems going FORWARD for the issue because there is only one thread using the ExternalAuth() object instantiated by the parent process. This eliminates the thread safety risk as the worker only processes one request at a time. 2) It is possible that at any time since the install/upgrade of AAP 2.5, that long lived Oauth tokens created in the components with the endpoints could implicate long term access to a different user's identity/privileges. Requests made with these tokens will appear to be from the user for which they were created and are indistinguishable from “valid” tokens that were created by the correct user: /api/controller/v2/tokens/ /api/controller/v2/applications/<id>/tokens/ /api/galaxy/v3/auth/token/ /api/controller/o/token/ Because it is likely not feasible to back trace every request that could have generated a token to its original request in the GRPC server, the most conservative and safe path to mitigate this risk would be to invalidate/revoke all existing oauth tokens in the components (hub, controller, eda).

Evidence timeline and material changes

Published upstream
Mar 3, 2025
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Nov 4, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Nov 4, 2026

Sources and claim methodology

Upstream source description

A flaw was found in the Ansible aap-gateway. Concurrent requests handled by the gateway grpc service can result in concurrency issues due to race condition requests against the proxy. This issue potentially allows a less privileged user to obtain the JWT of a greater privileged user, enabling the server to be jeopardized. A user session or confidential data might be vulnerable.

Quoted source text, attributed separately from HOL analysis.

Package

Affected range

Fixed version

automation-gatewaygeneric

>=2.5.0 <2.5.20250305-1

2.5.20250305-1

Recommended response

Check inventory. Check lockfiles and deployed manifests for automation-gateway.

Review the reported fix. Source-reported workaround: Follow the mitigation steps to avoid the flaw from happening. It is recommended to update the product after the fix is available. 1) set GRPC_SERVER_MAX_THREADS_PER_PROCESS = 1 This mitigates problems going FORWARD for the issue because there is only one thread using the ExternalAuth() object instantiated by the parent process. This eliminates the thread safety risk as the worker only processes one request at a time. 2) It is possible that at any time since the install/upgrade of AAP 2.5, that long lived Oauth tokens created in the components with the endpoints could implicate long term access to a different user's identity/privileges. Requests made with these tokens will appear to be from the user for which they were created and are indistinguishable from “valid” tokens that were created by the correct user: /api/controller/v2/tokens/ /api/controller/v2/applications/<id>/tokens/ /api/galaxy/v3/auth/token/ /api/controller/o/token/ Because it is likely not feasible to back trace every request that could have generated a token to its original request in the GRPC server, the most conservative and safe path to mitigate this risk would be to invalidate/revoke all existing oauth tokens in the components (hub, controller, eda).

Sources and claim methodology

Upstream source description

Quoted source text, attributed separately from HOL analysis.