Bug 2392834 (CVE-2025-9907)

Summary:	CVE-2025-9907 event-driven-ansible: Event Stream Test Mode Exposes Sensitive Headers in AAP EDA
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	haoli, hkataria, jajackso, jcammara, jmitchel, jneedle, kegrant, koliveir, kshier, mabashia, pbraun, security-response-team, shvarugh, simaishi, smcdonal, stcannon, teagle, tfister, thavo, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerability allows exposure of sensitive client credentials and internal infrastructure headers via the test_headers field when an event stream is in test mode. The possible outcome includes leakage of internal infrastructure details, accidental disclosure of user or system credentials, privilege escalation if high-value tokens are exposed, and persistent sensitive data exposure to all users with read access on the event stream.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2025-10-01

Description OSIDB Bzimport 2025-09-03 07:44:11 UTC

The EDA Event Stream API endpoint (/api/eda/v1/event-streams/<id>/) is exposing all received HTTP headers in the test_headers field when an event stream is in test mode. The core of this vulnerability is that headers sent by the client, such as the Authorization header, are always captured and exposed.

This issue is exacerbated when a user mistakenly posts to an internal API gateway path for the stream (e.g. /api/eda/... instead of /eda-event-streams/...). This action causes sensitive, infrastructure-level headers (e.g., X-Trusted-Proxy) to also be captured and exposed in addition to the client headers.

This behavior is inconsistent with the platform's established security pattern of not exposing credential contents via the API. Not only does it expose them to the user that may own the credential, but the vulnerability exposes these headers persistently to anyone with read access on the event stream (who shouldn't be able to see contents of the credential).