CVE-2025-9907 PUBLISHED CVSS 6.699999809265137 MEDIUM

A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerability allows exposure of sensitive client credentials and internal infrastructure headers via the test_headers field when an event stream is in test mode. The possible outcome includes leakage of internal infrastructure details, accidental disclosure of user or system credentials, privilege escalation if high-value tokens are exposed, and persistent sensitive data exposure to all users with read access on the event stream.

EPSS 0.01% · 1.4th percentile

Risk Scores

CVSS v3.1
6.699999809265137
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.01%
1.4th percentile

Affected Products

VendorProductVersions
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:1.6.0-1.el9ap, 0:1.6.0-1.el9ap, 0:1.6.0-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:9.0.1-1.el9ap, 0:9.0.1-1.el9ap, 0:9.0.1-1.el9ap
redhatansible_developer1.2, 1.3, 1.2
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:3.1.1-1.el9ap, 0:3.1.1-1.el9ap, 0:3.1.1-1.el9ap
redhatansible_automation_platform0, 0, 0
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:23.0.0-1.el8ap, 0:23.0.0-1.el8ap, 0:23.0.0-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:25.12.0-1.el9ap, 0:25.12.0-1.el9ap, 0:25.12.0-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:4.10.10-1.el8ap, 0:4.10.10-1.el8ap, 0:4.10.10-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:1.1.14-1.el8ap, 0:1.1.14-1.el8ap, 0:1.1.14-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:25.12.0-1.el9ap, 0:25.12.0-1.el9ap, 0:25.12.0-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:4.10.10-1.el8ap, 0:4.10.10-1.el8ap, 0:4.10.10-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:0.4.2-1.el8ap, 0:0.4.2-1.el8ap, 0:0.4.2-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.5sha256:07673470fb62db8bec12ec20b2500228c0c6d5108916dd936d91e10610b783d1, sha256:07673470fb62db8bec12ec20b2500228c0c6d5108916dd936d91e10610b783d1, sha256:07673470fb62db8bec12ec20b2500228c0c6d5108916dd936d91e10610b783d1
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:4.15.0-1.el8ap, 0:4.15.0-1.el8ap, 0:4.15.0-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:23.0.0-1.el9ap, 0:23.0.0-1.el9ap, 0:23.0.0-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:0.4.36-2.el8ap, 0:0.4.36-2.el8ap, 0:0.4.36-2.el8ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:3.8.0-1.el9ap, 0:3.8.0-1.el9ap, 0:3.8.0-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:3.8.0-1.el8ap, 0:3.8.0-1.el8ap, 0:3.8.0-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:4.15.0-1.el9ap, 0:4.15.0-1.el9ap, 0:4.15.0-1.el9ap
redhatansible_inside1.4, 1.4, 1.3

…and 38 more

Timeline

References

Open in Interactive Console →