CVE-2025-9908

Katalog CVE

CVSS 6.7 · Medium EPSS 0,20%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada redhat ansible automation platform, redhat ansible developer +1 lainnya. Skor CVSS 3.1 6.7 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Streams. This vulnerability allows an authenticated user to gain access to sensitive internal infrastructure headers (such as X-Trusted-Proxy and X-Envoy-*) and event stream URLs via crafted requests and job templates. By exfiltrating these headers, an attacker could spoof trusted requests, escalate privileges, or perform malicious event injection.

Rincian

Terbit di NVD

27 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.7 (Medium), sumber redhat.com
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2025:19201 advisory vendor
• https://access.redhat.com/errata/RHSA-2025:19221 advisory vendor
• https://access.redhat.com/errata/RHSA-2025:23069 advisory vendor
• https://access.redhat.com/errata/RHSA-2025:23131 advisory vendor
• https://access.redhat.com/security/cve/CVE-2025-9908 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2392835 issue tracking · advisory vendor