---
id: CVE-2025-9907
title: >-
  Event-driven-ansible: event stream test mode exposes sensitive headers in aap
  eda
summary: >-
  A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven
  Ansible (EDA) Event Stream API. This vulnerability allows exposure of
  sensitive client credentials and internal infrastructure headers via the
  test_headers field w…
severity: medium
cvss: 6.7
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-200
vendor: Red Hat
product: ansible-builder
affected:
  - ansible-builder (all versions)
  - ansible-creator (all versions)
  - ansible-dev-environment (all versions)
  - ansible-dev-tools (all versions)
  - ansible-lint (all versions)
  - ansible-navigator (all versions)
  - ansible-sign (all versions)
  - automation-eda-controller (all versions)
  - automation-hub (all versions)
  - bindep (all versions)
  - molecule (all versions)
  - python3.11-ansible-compat (all versions)
  - python3.11-distlib (all versions)
  - python3.11-django (all versions)
  - python3.11-execnet (all versions)
  - python3.11-galaxy-importer (all versions)
  - python3.11-galaxy-ng (all versions)
  - python3.11-gunicorn (all versions)
  - python3.11-pluggy (all versions)
  - python3.11-pytest (all versions)
  - python3.11-pytest-ansible (all versions)
  - python3.11-pytest-xdist (all versions)
  - python3.11-ruamel-yaml-clib (all versions)
  - python3.11-subprocess-tee (all versions)
  - python3.11-tox-ansible (all versions)
  - python3.11-typing-extensions (all versions)
  - ansible-builder (all versions)
  - ansible-creator (all versions)
  - ansible-dev-environment (all versions)
  - ansible-dev-tools (all versions)
  - ansible-lint (all versions)
  - ansible-navigator (all versions)
  - ansible-sign (all versions)
  - automation-eda-controller (all versions)
  - automation-hub (all versions)
  - bindep (all versions)
  - molecule (all versions)
  - python3.11-ansible-compat (all versions)
  - python3.11-distlib (all versions)
  - python3.11-django (all versions)
  - python3.11-execnet (all versions)
  - python3.11-galaxy-importer (all versions)
  - python3.11-galaxy-ng (all versions)
  - python3.11-gunicorn (all versions)
  - python3.11-pluggy (all versions)
  - python3.11-pytest (all versions)
  - python3.11-pytest-ansible (all versions)
  - python3.11-pytest-xdist (all versions)
  - python3.11-ruamel-yaml-clib (all versions)
  - python3.11-subprocess-tee (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-02-27T00:00:00+00:00'
published: '2026-02-27'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T16:09:16.514Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-9907'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2025:19201'
    label: 'RHSA-2025:19201'
  - url: 'https://access.redhat.com/errata/RHSA-2025:19221'
    label: 'RHSA-2025:19221'
  - url: 'https://access.redhat.com/errata/RHSA-2025:23069'
    label: 'RHSA-2025:23069'
  - url: 'https://access.redhat.com/errata/RHSA-2025:23131'
    label: 'RHSA-2025:23131'
  - url: 'https://access.redhat.com/security/cve/CVE-2025-9907'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2392834'
    label: RHBZ#2392834
tags:
  - cve.org
epss: 0.00184
epssPercentile: 0.0807
ingestedAt: '2026-11-05T22:38:31.335Z'
---

## Overview

A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerability allows exposure of sensitive client credentials and internal infrastructure headers via the test_headers field when an event stream is in test mode. The possible outcome includes leakage of internal infrastructure details, accidental disclosure of user or system credentials, privilege escalation if high-value tokens are exposed, and persistent sensitive data exposure to all users with read access on the event stream.

## Affected

- `ansible-builder (all versions)`
- `ansible-creator (all versions)`
- `ansible-dev-environment (all versions)`
- `ansible-dev-tools (all versions)`
- `ansible-lint (all versions)`
- `ansible-navigator (all versions)`
- `ansible-sign (all versions)`
- `automation-eda-controller (all versions)`
- `automation-hub (all versions)`
- `bindep (all versions)`
- `molecule (all versions)`
- `python3.11-ansible-compat (all versions)`
- `python3.11-distlib (all versions)`
- `python3.11-django (all versions)`
- `python3.11-execnet (all versions)`
- `python3.11-galaxy-importer (all versions)`
- `python3.11-galaxy-ng (all versions)`
- `python3.11-gunicorn (all versions)`
- `python3.11-pluggy (all versions)`
- `python3.11-pytest (all versions)`
- `python3.11-pytest-ansible (all versions)`
- `python3.11-pytest-xdist (all versions)`
- `python3.11-ruamel-yaml-clib (all versions)`
- `python3.11-subprocess-tee (all versions)`
- `python3.11-tox-ansible (all versions)`
- `python3.11-typing-extensions (all versions)`
- `ansible-builder (all versions)`
- `ansible-creator (all versions)`
- `ansible-dev-environment (all versions)`
- `ansible-dev-tools (all versions)`
- `ansible-lint (all versions)`
- `ansible-navigator (all versions)`
- `ansible-sign (all versions)`
- `automation-eda-controller (all versions)`
- `automation-hub (all versions)`
- `bindep (all versions)`
- `molecule (all versions)`
- `python3.11-ansible-compat (all versions)`
- `python3.11-distlib (all versions)`
- `python3.11-django (all versions)`
- `python3.11-execnet (all versions)`
- `python3.11-galaxy-importer (all versions)`
- `python3.11-galaxy-ng (all versions)`
- `python3.11-gunicorn (all versions)`
- `python3.11-pluggy (all versions)`
- `python3.11-pytest (all versions)`
- `python3.11-pytest-ansible (all versions)`
- `python3.11-pytest-xdist (all versions)`
- `python3.11-ruamel-yaml-clib (all versions)`
- `python3.11-subprocess-tee (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.