CVE-2025-9907

Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda

State: Published
Severity: 6.7 Medium
Published: Feb 27, 2026
Updated: Feb 28, 2026
Reserved: Sep 3, 2025

Description

A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerability allows exposure of sensitive client credentials and internal infrastructure headers via the test_headers field when an event stream is in test mode. The possible outcome includes leakage of internal infrastructure details, accidental disclosure of user or system credentials, privilege escalation if high-value tokens are exposed, and persistent sensitive data exposure to all users with read access on the event stream.

Scores

CVSS	Score	Vector	Source
3.1	6.7 Medium	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	redhat

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:3.1.1-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:25.12.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:25.12.2-1.1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:25.12.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:25.12.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:25.12.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:0.1.4-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:1.1.14-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:4.10.10-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:2.13.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:25.12.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:25.12.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:0.4.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:4.2.26-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:2.1.2-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:0.4.36-2.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:4.10.10-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:23.0.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:1.6.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:9.0.1-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:25.12.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:3.8.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:0.2.15-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:0.4.2-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:25.12.0-1.2.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:4.15.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:3.1.1-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:25.12.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:25.12.2-1.1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:25.12.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:25.12.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:25.12.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:0.1.4-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:1.1.14-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:4.10.10-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:2.13.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:25.12.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:25.12.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:0.4.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:4.2.26-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:2.1.2-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:0.4.36-2.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:4.10.10-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:23.0.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:1.6.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:9.0.1-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:25.12.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:3.8.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:0.2.15-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:0.4.2-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:25.12.0-1.2.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:4.15.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.6 for RHEL 9Red Hat	0:1.2.1-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5Red Hat	sha256:07673470fb62db8bec12ec20b2500228c0c6d5108916dd936d91e10610b783d1 and laterNot affected
Red Hat Ansible Automation Platform 2.6Red Hat	sha256:142125ce7f176ce4d9755f3124714bbfd8e10a687378988761d5451bd135ca76 and laterNot affected

References

RHSA-2025:19201vendor-advisory
RHSA-2025:19221vendor-advisory
RHSA-2025:23069vendor-advisory
RHSA-2025:23131vendor-advisory
https://access.redhat.com/security/cve/CVE-2025-9907vdb-entry
RHBZ#2392834issue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.