CVE-2025-53861— Aap: sensitive cookie(s) set without security flags
Quick assessment
Affected
Red Hat Red Hat Ansible Automation Platform 2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Red Hat Ansible是美国红帽（Red Hat）公司的一款计算机系统配置管理器。该产品可用于发布、管理和编排计算机系统。 Red Hat Ansible存在安全漏洞，该漏洞源于安全标志缺失，可能导致中间人攻击和跨站脚本攻击。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1557 · Adversary-in-the-Middle
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-53861
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Aap: sensitive cookie(s) set without security flags
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Ansible. Sensitive cookies without security flags over non-encrypted channels can lead to Man-in-the-Middle (MitM) and Cross-site scripting (XSS) attacks allowing attackers to read transmitted data.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
敏感数据的明文传输
Source: CVE Program / CVE List V5
Vulnerability Title
Red Hat Ansible 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Red Hat Ansible是美国红帽（Red Hat）公司的一款计算机系统配置管理器。该产品可用于发布、管理和编排计算机系统。 Red Hat Ansible存在安全漏洞，该漏洞源于安全标志缺失，可能导致中间人攻击和跨站脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
II. Public POCs for CVE-2025-53861
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-53861
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Red Hat Ansible Automation Platform 2
-
CVE-2026-12564
Automation-controller: automation-controller: kubernetes ser -
CVE-2026-19730
Podman: podman: quadlet install --replace non-truncating wri -
CVE-2026-44191
Ansible-lightspeed: visual studio code ansible lightspeed ex -
CVE-2026-44187
Ansible-lightspeed: ansible lightspeed extension for visual -
CVE-2026-44192
Ansible-lightspeed: ansible lightspeed mcp server: remote co
Same vendor: Red Hat
-
CVE-2026-17113
Cri-o: cri-o: unvalidated image env var causes daemon crash -
CVE-2026-78475
Gimp: unbounded stack vla and 21-byte stack over-read in pix -
CVE-2026-78465
Gimp: integer overflow in pcx loader (planes=4) leads to hea -
CVE-2026-19685
Networkmanager: networkmanager: 802-1x ca-path and phase2-ca -
CVE-2026-71366
Awx: notification backends allow ssrf and credential leakage
Same weakness: CWE-319
-
CVE-2026-12556
HP Easy Start for macOS - Security Update -
CVE-2026-19683
Unencrypted Credential Transmission in Omada Gateway Dynamic -
CVE-2026-76244
stigmem-node Insecure Federation Transport Configuration -
CVE-2026-15806
`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP -
CVE-2026-20294
Cisco Catalyst SD-WAN Manager Information Disclosure Vulnera
V. Comments for CVE-2025-53861
No comments yet