The EDA Event Stream API endpoint (/api/eda/v1/event-streams/<id>/) is exposing all received HTTP headers in the test_headers field when an event stream is in test mode. The core of this vulnerability is that headers sent by the client, such as the Authorization header, are always captured and exposed.

This issue is exacerbated when a user mistakenly posts to an internal API gateway path for the stream (e.g. /api/eda/... instead of /eda-event-streams/...). This action causes sensitive, infrastructure-level headers (e.g., X-Trusted-Proxy) to also be captured and exposed in addition to the client headers.

This behavior is inconsistent with the platform's established security pattern of not exposing credential contents via the API. Not only does it expose them to the user that may own the credential, but the vulnerability exposes these headers persistently to anyone with read access on the event stream (who shouldn't be able to see contents of the credential).