A user can gain access to sensitive infrastructure headers and event stream url which has been characterized as sensitive (to avoid DDoS type attacks).

If there is an event stream set up by an administrator, and a credential to the controller to allow job template action (they could create that or have it shared with them), they can gain knowledge of other sensitive internal headers, including, but not limited to, X-Trusted-Proxy.