CVE-2025-9909

Aap-gateway: improper path validation in gateway allows credential exfiltration

State: Published
Severity: 6.7 Medium
Published: Feb 27, 2026
Updated: Feb 27, 2026
Reserved: Sep 3, 2025

Description

A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of misleading routes using a double-slash (//) prefix in the gateway_path. A malicious or socially engineered administrator can configure a honey-pot route to intercept and exfiltrate user credentials, potentially maintaining persistent access or creating a backdoor even after their permissions are revoked.

Scores

CVSS	Score	Vector	Source
3.1	6.7 Medium	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	redhat

Weaknesses

CWE-647 Use of Non-Canonical URL Paths for Authorization Decisions

Affected Products

Product	Versions
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:3.1.1-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:25.12.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:25.12.2-1.1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:25.12.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:25.12.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:25.12.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:0.1.4-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:2.5.20251210-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:4.10.10-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:2.13.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:25.12.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:25.12.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:0.4.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:4.2.26-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:2.1.2-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:0.4.36-2.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:4.10.10-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:23.0.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:1.6.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:9.0.1-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:25.12.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:3.8.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:0.2.15-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:0.4.2-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:25.12.0-1.2.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:4.15.0-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:3.1.1-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:25.12.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:25.12.2-1.1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:25.12.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:25.12.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:25.12.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:0.1.4-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:2.5.20251210-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:4.10.10-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:2.13.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:25.12.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:25.12.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:0.4.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:4.2.26-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:2.1.2-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:0.4.36-2.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:4.10.10-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:23.0.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:1.6.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:9.0.1-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:25.12.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:3.8.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:0.2.15-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:0.4.2-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:25.12.0-1.2.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:4.15.0-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.6 for RHEL 9Red Hat	0:2.6.20251119-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5Red Hat	sha256:93b5d66f1fa8a3241d999df47c8430c13fa11b751b5fc3d4a8fd2a39d282b3fd and laterNot affected
Red Hat Ansible Automation Platform 2.6Red Hat	sha256:d6bd83a65b6a0ca9cead0652736c51dd1ab02fc8d9ee2a5c19e413a5239c0cb7 and laterNot affected

References

RHSA-2025:21768vendor-advisory
RHSA-2025:21775vendor-advisory
RHSA-2025:23069vendor-advisory
RHSA-2025:23131vendor-advisory
https://access.redhat.com/security/cve/CVE-2025-9909vdb-entry
RHBZ#2392836issue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.