CVE-2025-9907: Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda
A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerability allows exposure of sensitive client credentials and internal infrastructure headers via the testheaders field when an event stream is in test mode. The possible outcome includes leakage of internal infrastructure details, accidental disclosure of user or system credentials, privilege escalation if high-value tokens are exposed, and persistent sensitive data exposure to all users with read access on the event stream.
Other sources
The EDA Event Stream API endpoint (/api/eda/v1/event-streams/<id>/) is exposing all received HTTP headers in the testheaders field when an event stream is in test mode. The core of this vulnerability is that headers sent by the client, such as the Authorization header, are always captured and exposed.
This issue is exacerbated when a user mistakenly posts to an internal API gateway path for the stream (e.g. /api/eda/... instead of /eda-event-streams/...). This action causes sensitive, infrastructure-level headers (e.g., X-Trusted-Proxy) to also be captured and exposed in addition to the client headers.
This behavior is inconsistent with the platform's established security pattern of not exposing credential contents via the API. Not only does it expose them to the user that may own the credential, but the vulnerability exposes these headers persistently to anyone with read access on the event stream (who shouldn't be able to see contents of the credential).
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9907?
CVE-2025-9907 is classified as a moderate severity vulnerability due to the potential exposure of sensitive client credentials.
How do I fix CVE-2025-9907?
To fix CVE-2025-9907, update the Red Hat Ansible Automation Platform to the latest patched version provided by Red Hat.
What types of systems are affected by CVE-2025-9907?
CVE-2025-9907 affects the Red Hat Ansible Automation Platform, specifically the Event-Driven Ansible (EDA) Event Stream API.
What are the potential consequences of CVE-2025-9907?
The potential consequences of CVE-2025-9907 include unauthorized access to sensitive client credentials and internal infrastructure headers.
Is there a workaround for CVE-2025-9907?
Currently, there are no recommended workarounds for CVE-2025-9907; updating to a secure version is advised.