CVE-2025-9909: redhat ansible_automation_platform

Vulnerability summary

CVE-2025-9909 is a medium (CVSS 6.7) vulnerability in redhat ansible_automation_platform. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.4% of scored vulnerabilities.

Timeline

1. 27-02-2026
   PublishedVulnerability first disclosed.
2. 27-02-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of misleading routes using a double-slash (//) prefix in the gateway_path. A malicious or socially engineered administrator can configure a honey-pot route to intercept and exfiltrate user credentials, potentially maintaining persistent access or creating a backdoor even after their permissions are revoked.

• CWE-647Use of Non-Canonical URL Paths for Authorization DecisionsThe product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.