CERT24CVE-2025-49521 — Template injection via Git branch and refspec in EDA projectsLoading data…
CERT24Threat Observatory
Period

CVE-2025-49521 — Template injection via Git branch and refspec in EDA projects

A flaw in the EDA component of Ansible Automation Platform causes user-supplied Git branch or refspec values to be evaluated as Jinja2 templates. Authenticated users may inject expressions that execute commands or access sensitive files on the EDA worker. In OpenShift, this may lead to service account token theft.

← Back to intelligence

CVE-2025-49521 — Template injection via Git branch and refspec in EDA projects

A flaw in the EDA component of Ansible Automation Platform causes user-supplied Git branch or refspec values to be evaluated as Jinja2 templates. Authenticated users may inject expressions that execute commands or access sensitive files on the EDA worker. In OpenShift, this may lead to service account token theft.