VYPR
← All advisories
Medium severity6.7NVD Advisory· Published Feb 27, 2026· Updated Jun 17, 2026

CVE-2025-9907

CVE-2025-9907

Description

A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerability allows exposure of sensitive client credentials and internal infrastructure headers via the test_headers field when an event stream is in test mode. The possible outcome includes leakage of internal infrastructure details, accidental disclosure of user or system credentials, privilege escalation if high-value tokens are exposed, and persistent sensitive data exposure to all users with read access on the event stream.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

10
  • Red Hat/Ansible Automation Platformcpe-rescue6 versions
    cpe:/a:redhat:ansible_automation_platform:2.5::el8+ 5 more
    • cpe:/a:redhat:ansible_automation_platform:2.5::el8range: sha256:07673470fb62db8bec12ec20b2500228c0c6d5108916dd936d91e10610b783d1
    • cpe:/a:redhat:ansible_automation_platform:2.6::el9range: sha256:142125ce7f176ce4d9755f3124714bbfd8e10a687378988761d5451bd135ca76
    • cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9range: 0:1.2.1-1.el9ap
    • cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9range: 0:4.15.0-1.el9ap
    • cpe:2.3:a:redhat:ansible_automation_platform:*:*:*:*:*:*:*:*range: <2.6
    • (no CPE)
  • Red Hat/Ansible Developer2 versions
    cpe:2.3:a:redhat:ansible_developer:1.2:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:redhat:ansible_developer:1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:ansible_developer:1.3:*:*:*:*:*:*:*
  • Red Hat/Ansible Inside2 versions
    cpe:2.3:a:redhat:ansible_inside:1.3:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:redhat:ansible_inside:1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:ansible_inside:1.4:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.