CVE-2025-9909: Aap-gateway: improper path validation in gateway allows credential exfiltration
A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of misleading routes using a double-slash (//) prefix in the gatewaypath. A malicious or socially engineered administrator can configure a honey-pot route to intercept and exfiltrate user credentials, potentially maintaining persistent access or creating a backdoor even after their permissions are revoked.
Other sources
Gateway lets an administrator create routes. There is some validation, but they allow routes starting a double slash (//), that look very much like legitimate URLs. This can be used to set up a "honey-pot" route to capture and exfiltrate user credentials.
This is a problem because a malicious admin could use this to create a backdoor to retain access after their permissions are revoked. It could also be exploited by an external attacker who social engineers a legitimate admin, convincing them to add the route for "troubleshooting" or "diagnostics" without the admin knowing what it's really for.
A core issue is that the gatewaypath field doesn't properly sanitize its input, allowing these look-alike paths to be created.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9909?
The severity of CVE-2025-9909 is categorized as high due to its potential for allowing credential exfiltration.
How do I fix CVE-2025-9909?
To fix CVE-2025-9909, ensure proper input validation on route creation to disallow routes beginning with a double slash (//).
What systems are affected by CVE-2025-9909?
CVE-2025-9909 affects systems using the vulnerable gateway configuration feature that allows route creation by administrators.
Can CVE-2025-9909 be exploited remotely?
Yes, CVE-2025-9909 can potentially be exploited remotely if a malicious administrator configures the routes.
What are the potential impacts of CVE-2025-9909?
The potential impacts of CVE-2025-9909 include unauthorized access to user credentials and data exfiltration.