CVE-2025-9908 PUBLISHED CVSS 6.699999809265137 MEDIUM

A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Streams. This vulnerability allows an authenticated user to gain access to sensitive internal infrastructure headers (such as X-Trusted-Proxy and X-Envoy-*) and event stream URLs via crafted requests and job templates. By exfiltrating these headers, an attacker could spoof trusted requests, escalate privileges, or perform malicious event injection.

EPSS 0.01% · 2.2th percentile

Risk Scores

CVSS v3.1
6.699999809265137
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.01%
2.2th percentile

Affected Products

VendorProductVersions
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:0.4.0-1.el8ap, 0:0.4.0-1.el8ap, 0:0.4.0-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 90:1.2.1-1.el9ap, 0:1.2.1-1.el9ap, 0:1.2.1-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:2.13.0-1.el9ap, 0:2.13.0-1.el9ap, 0:2.13.0-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:9.0.1-1.el9ap, 0:9.0.1-1.el9ap, 0:9.0.1-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:2.13.0-1.el8ap, 0:2.13.0-1.el8ap, 0:2.13.0-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:25.12.0-1.el9ap, 0:25.12.0-1.el9ap, 0:25.12.0-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:25.12.0-1.el9ap, 0:25.12.0-1.el9ap, 0:25.12.0-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:3.8.0-1.el9ap, 0:3.8.0-1.el9ap, 0:3.8.0-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:25.12.0-1.el9ap, 0:25.12.0-1.el9ap, 0:25.12.0-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:25.12.0-1.el9ap, 0:25.12.0-1.el9ap, 0:25.12.0-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:25.12.0-1.el8ap, 0:25.12.0-1.el8ap, 0:25.12.0-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:4.2.26-1.el8ap, 0:4.2.26-1.el8ap, 0:4.2.26-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:3.1.1-1.el9ap, 0:3.1.1-1.el9ap, 0:3.1.1-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:4.15.0-1.el8ap, 0:4.15.0-1.el8ap, 0:4.15.0-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:25.12.0-1.el8ap, 0:25.12.0-1.el8ap, 0:25.12.0-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:0.1.4-1.el8ap, 0:0.1.4-1.el8ap, 0:0.1.4-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:25.12.0-1.2.el8ap, 0:25.12.0-1.2.el8ap, 0:25.12.0-1.2.el8ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:3.1.1-1.el8ap, 0:3.1.1-1.el8ap, 0:3.1.1-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:4.15.0-1.el9ap, 0:4.15.0-1.el9ap, 0:4.15.0-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:1.1.14-1.el8ap, 0:1.1.14-1.el8ap, 0:1.1.14-1.el8ap

…and 38 more

Timeline

References

Open in Interactive Console →