CVE-2025-49520: Ansible EDA Component RCE Vulnerability

CVE-2025-49520 Overview

CVE-2025-49520 is an argument injection vulnerability in the Event-Driven Ansible (EDA) component of Red Hat Ansible Automation Platform. The EDA worker passes user-supplied Git URLs directly to the git ls-remote command without sanitization. An authenticated attacker can craft a malicious URL that injects additional arguments to the git binary, leading to arbitrary command execution on the EDA worker host.

In Kubernetes and OpenShift deployments, the resulting code execution can be leveraged to steal the pod's service account token and pivot to broader cluster access. The flaw is tracked under [CWE-88] (Improper Neutralization of Argument Delimiters in a Command).

Critical Impact
Authenticated attackers can execute arbitrary commands on the EDA worker and exfiltrate Kubernetes service account tokens, enabling lateral movement within the cluster.

Affected Products

Red Hat Ansible Automation Platform (Event-Driven Ansible component)
EDA worker deployments on Kubernetes and OpenShift
See Red Hat Security Errata RHSA-2025:9986 for fixed versions

Discovery Timeline

2025-06-30 - CVE-2025-49520 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49520

Vulnerability Analysis

The EDA component allows users to register Git-based project sources. When the worker resolves a remote repository, it invokes git ls-remote with the user-supplied URL as an argument. Because the URL value is concatenated into the command without filtering or use of the -- end-of-options separator, an attacker controlling the URL field can supply a string that git interprets as an additional command-line option rather than as a repository reference.

Git supports several options that trigger external program execution, including --upload-pack, --exec, and -c core.sshCommand=. Supplying a crafted value through the project URL field allows the attacker to chain these options and run arbitrary binaries under the identity of the EDA worker process.

In containerized deployments, the worker pod is typically bound to a Kubernetes service account. Command execution inside the pod exposes the projected token at /var/run/secrets/kubernetes.io/serviceaccount/token, which the attacker can read and reuse against the cluster API server.

Root Cause

The root cause is improper neutralization of argument delimiters [CWE-88]. The EDA project loader does not validate that the URL begins with an expected scheme, does not reject strings starting with -, and does not use git's -- separator before user input.

Attack Vector

Exploitation requires an authenticated account with permission to create or modify an EDA project. The attacker submits a project whose source URL is a crafted option string. When the worker invokes git ls-remote against that project, the injected option triggers execution of attacker-controlled code on the worker.

Further exploitation steps and a proof-of-concept are referenced in the Red Hat Bug Report #2370812.

Detection Methods for CVE-2025-49520

Indicators of Compromise

EDA project entries whose Git URL field begins with -, --upload-pack=, --exec=, or contains core.sshCommand
git child processes on EDA workers spawning unexpected binaries such as sh, bash, curl, or wget
Outbound network connections from EDA worker pods to attacker-controlled hosts shortly after a project sync
Reads of /var/run/secrets/kubernetes.io/serviceaccount/token from processes other than the EDA worker entry point

Detection Strategies

Inspect EDA project records and audit logs for URLs that do not begin with http://, https://, git://, or ssh://
Monitor process execution on EDA workers for git ls-remote invocations whose argument list contains option flags after the URL position
Correlate Kubernetes API audit logs with EDA worker pod identities to flag unexpected use of the service account token

Monitoring Recommendations

Enable Kubernetes audit logging at the Metadata level or higher for the EDA namespace and forward events to a central SIEM
Alert on new child processes of the EDA worker container that are not on an established allowlist
Track egress traffic from EDA pods and baseline expected destinations such as Git hosting providers

How to Mitigate CVE-2025-49520

Immediate Actions Required

Apply the updates published in RHSA-2025:9986 to all Ansible Automation Platform installations running EDA
Review existing EDA project definitions and remove or correct any URL beginning with - or containing shell metacharacters
Rotate Kubernetes service account tokens bound to EDA worker pods if compromise is suspected

Patch Information

Red Hat has issued fixed packages through RHSA-2025:9986. The advisory and component-level details are documented at the Red Hat CVE page for CVE-2025-49520.

Workarounds

Restrict EDA project creation and modification permissions to a minimal set of trusted administrators until patches are applied
Apply a Kubernetes NetworkPolicy to EDA worker pods limiting egress to known Git hosts only
Bind EDA worker pods to a service account with the least privileges required, and disable automatic token mounting where Git operations do not require API access

bash

# Example: restrict EDA worker pod egress and disable token automount
apiVersion: v1
kind: ServiceAccount
metadata:
  name: eda-worker
  namespace: aap
automountServiceAccountToken: false
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: eda-worker-egress
  namespace: aap
spec:
  podSelector:
    matchLabels:
      app: eda-worker
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 140.82.112.0/20  # example: GitHub
    ports:
    - protocol: TCP
      port: 443