REDHAT-BUG-2549510: Medium severity redhat/automation-gateway vulnerability
Rate Moderate - exploitation requires an authenticated user with the collection-namespace owner role to store the payload (roleless upload is rejected), and a separate authenticated viewer must actively activate the crafted link (no execution on page load); the build CSP does not block the script-executing scheme. Component mapping confirmed via newcli: Platform UI assets ship in automation-gateway (2.5 RPM), automation-platform-ui (2.6 RPM), and the gateway-rhel9 container (2.6 and 2.7); standalone ansible-hub-ui uses a different, non-reproduced renderer. Source flaw component = upstream ansible-ui (frontend/hub).
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The affected Platform UI assets ship in automation-gateway 2.5 RPM, automation-platform-ui 2.6 RPM, and the gateway-rhel9 container versions 2.6 and 2.7. Standalone ansible-hub-ui uses a different renderer and was not reproduced as affected.
What access and user interaction are required for exploitation?
An authenticated user with the collection-namespace owner role must first store the crafted payload; uploads without that role are rejected. A separate authenticated viewer must then actively activate the crafted link, because the payload does not execute on page load.
Does the build content security policy prevent exploitation?
No. The build CSP does not block the script-executing scheme used by the crafted link.