CVE-2025-9907

Katalog CVE

CVSS 6.7 · Medium EPSS 0,17%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada redhat ansible automation platform, redhat ansible developer +1 lainnya. Skor CVSS 3.1 6.7 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerability allows exposure of sensitive client credentials and internal infrastructure headers via the test_headers field when an event stream is in test mode. The possible outcome includes leakage of internal infrastructure details, accidental disclosure of user or system credentials, privilege escalation if high-value tokens are exposed, and persistent sensitive data exposure to all users with read access on the event stream.

Rincian

Terbit di NVD

27 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.7 (Medium), sumber redhat.com
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 5,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2025:19201 advisory vendor
• https://access.redhat.com/errata/RHSA-2025:19221 advisory vendor
• https://access.redhat.com/errata/RHSA-2025:23069 advisory vendor
• https://access.redhat.com/errata/RHSA-2025:23131 advisory vendor
• https://access.redhat.com/security/cve/CVE-2025-9907 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2392834 issue tracking · advisory vendor