6.7
Medium
CVE-2025-9909 Aap-gateway: improper path validation in gateway allows credential exfiltration
Description
A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of misleading routes using a double-slash (//) prefix in the gateway_path. A malicious or socially engineered administrator can configure a honey-pot route to intercept and exfiltrate user credentials, potentially maintaining persistent access or creating a backdoor even after their permissions are revoked.
CVSS 3.1 detail
Vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitable with local access to the machine, with an administrator account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- High
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Versions not published | |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.5 2.5 | earliest → < 2.5 | 2.5 |
| Red Hat Ansible Automation Platform 2.6 2.6 | earliest → < 2.6 | 2.6 |
References
- RHSA-2025:21768 access.redhat.com
- RHSA-2025:21775 access.redhat.com
- RHSA-2025:23069 access.redhat.com
- RHSA-2025:23131 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2392836 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Ansible Automation Platform 2.5 for RHEL 8
The 100 CVEs of Red Hat Ansible Automation Platform 2.5 for RHEL 8 →
CVE-2026-84724
Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process
6.6
Medium
CVE-2026-84720
Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracle
6.5
Medium
CVE-2026-84718
Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust
4.3
Medium
CVE-2026-84717
Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templates
5.3
Medium