CVE-2025-9908: Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams
A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Streams. This vulnerability allows an authenticated user to gain access to sensitive internal infrastructure headers (such as X-Trusted-Proxy and X-Envoy-) and event stream URLs via crafted requests and job templates. By exfiltrating these headers, an attacker could spoof trusted requests, escalate privileges, or perform malicious event injection.
Other sources
A user can gain access to sensitive infrastructure headers and event stream url which has been characterized as sensitive (to avoid DDoS type attacks).
If there is an event stream set up by an administrator, and a credential to the controller to allow job template action (they could create that or have it shared with them), they can gain knowledge of other sensitive internal headers, including, but not limited to, X-Trusted-Proxy.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9908?
CVE-2025-9908 has been classified as a medium severity vulnerability due to the unauthorized access to sensitive internal headers.
How do I fix CVE-2025-9908?
To fix CVE-2025-9908, upgrade to a patched version of the Red Hat Ansible Automation Platform as indicated in the vendor's advisories.
Who is affected by CVE-2025-9908?
CVE-2025-9908 affects users of the Red Hat Ansible Automation Platform, specifically those using Event-Driven Ansible event streams.
What types of data are exposed in CVE-2025-9908?
CVE-2025-9908 exposes sensitive internal infrastructure headers which could lead to further exploitation or data leakage.
Is authentication required to exploit CVE-2025-9908?
Yes, CVE-2025-9908 requires authentication as it allows access to sensitive information for already authenticated users.