CVE-2025-49521: Jinja2 Template Injection in Event-Driven Ansible

The impact of CVE-2025-49521 is significant due to the ability of authenticated users to execute arbitrary commands on the EDA worker. This could lead to complete system compromise, data exfiltration, and disruption of automation workflows. In OpenShift deployments, the vulnerability presents a particularly severe risk, as attackers can potentially steal service account tokens, enabling lateral movement and privilege escalation within the cluster. The ability to access sensitive files further expands the attack surface, potentially exposing credentials, configuration data, or other confidential information. This vulnerability shares similarities with other Jinja2 template injection flaws, where improper sanitization of user input allows for code execution.

1. Reserved2025-06-06
2. Published2025-06-30
3. Modified2025-11-13
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-49521 is to upgrade to a patched version of Event-Driven Ansible as soon as it becomes available. Until an upgrade is possible, several workarounds can be implemented to reduce the risk. First, strictly restrict the allowed Git branch and refspec input to prevent malicious expressions from being injected. Second, review and minimize the permissions granted to the EDA worker to limit the potential impact of a successful attack. Consider implementing a Web Application Firewall (WAF) or proxy to filter potentially malicious requests. Regularly monitor EDA worker logs for suspicious activity, such as attempts to execute commands or access unauthorized files. After upgrading, confirm the fix by attempting to trigger the vulnerable Git operation with a known malicious payload and verifying that it is properly sanitized.