CVE-2025-5988CWE-352

Aap-gateway: csrf origin checking is disabled

Medium · published August 4, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
17.4
In the wild
Unconfirmed
What it is

A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00265 · 17.4th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-08-04T15:16Z
EPSS history
Timeline
  • 04 AUG 15:16Z
    Aap-gateway: csrf origin checking is disabled
    cvelistv5