CVE-2025-9908
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
33/100
Published: 2026-02-27
Modified: 2026-11-05
First seen: 2026-11-05
Status: active
Attack Surface
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
High
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Streams. This vulnerability allows an authenticated user to gain access to sensitive internal infrastructure headers (such as X-Trusted-Proxy and X-Envoy-*) and event stream URLs via crafted requests and job templates. By exfiltrating these headers, an attacker could spoof trusted requests, escalate privileges, or perform malicious event injection.
Weakness Classification (1)
Affected Software (5)
| Vendor | Product | Version |
|---|---|---|
| redhat | ansible_automation_platform | < 2.6 |
| redhat | ansible_developer | 1.2 |
| redhat | ansible_developer | 1.3 |
| redhat | ansible_inside | 1.3 |
| redhat | ansible_inside | 1.4 |
References & Advisories (6)
vendor-advisory
x_refsource_REDHAT
vendor-advisory
x_refsource_REDHAT
vendor-advisory
x_refsource_REDHAT
vendor-advisory
x_refsource_REDHAT
vdb-entry
x_refsource_REDHAT
issue-tracking
x_refsource_REDHAT