CVE-2025-9909
A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of misleading routes using a double-slash (//) prefix in the gateway_path. A malicious or socially engineered administrator can configure a honey-pot route to intercept and exfiltrate user credentials, potentially maintaining persistent access or creating a backdoor even after their permissions are revoked.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.7
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.17%
- CWE
- CWE-647
- Published
- 2026-02-27
- Last modified
- 2026-03-12
Affected products
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
Weakness type
Related vulnerabilities
- CVE-2026-80515 — In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects...
- CVE-2026-15970 — L7 intention authorization bypass via custom public listener
- CVE-2026-62685 — File Browser: Colliding username normalization gives two users the same home directory
- CVE-2026-8384 — In Eclipse Jetty, an HTTP URI of this form:...
- CVE-2026-59731 — Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
- CVE-2026-5222 — Cargo can be coerced to share credentials between registries
- CVE-2025-66202 — Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765
- CVE-2025-64500 — Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass