How severe is CVE-2025-9909?

CVE-2025-9909 has a CVSS 3.x base score of 6.7, rated medium severity. It is exploitable over local access with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-9909 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-9909?

CVE-2025-9909 primarily affects Redhat Ansible Automation Platform. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2025-9909?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-9909 have an EU (EUVD) identifier?

Yes. CVE-2025-9909 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-208134.

When was CVE-2025-9909 published?

CVE-2025-9909 was published on 2026-02-27 and last updated on 2026-06-17.

CVE-2025-9909

CVE-2025-9909 is a medium-severity vulnerability in Redhat Ansible Automation Platform with a CVSS 3.x base score of 6.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-647.

Key facts

Severity: Medium (CVSS 3.x base score 6.7)
EPSS exploit prediction: 0% (6th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-208134
Weakness: CWE-647
Affected product: Redhat Ansible Automation Platform
Published: 2026-02-27
Last modified: 2026-06-17

Description

A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of misleading routes using a double-slash (//) prefix in the gateway_path. A malicious or socially engineered administrator can configure a honey-pot route to intercept and exfiltrate user credentials, potentially maintaining persistent access or creating a backdoor even after their permissions are revoked.

Frequently asked questions

What is CVE-2025-9909?: A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of misleading routes using a double-slash (//) prefix in the gateway_path. A malicious or socially engineered administrator can configure a honey-pot route to intercept and exfiltrate user credentials, potentially maintaining persistent access or creating a backdoor even after their permissions are revoked.
How severe is CVE-2025-9909?: CVE-2025-9909 has a CVSS 3.x base score of 6.7, rated medium severity. It is exploitable over local access with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-9909 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-9909?: CVE-2025-9909 primarily affects Redhat Ansible Automation Platform. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2025-9909?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-9909 have an EU (EUVD) identifier?: Yes. CVE-2025-9909 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-208134.
When was CVE-2025-9909 published?: CVE-2025-9909 was published on 2026-02-27 and last updated on 2026-06-17.

References

Affected products (5)

cpe:2.3:a:redhat:ansible_automation_platform:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ansible_developer:1.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ansible_developer:1.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ansible_inside:1.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ansible_inside:1.4:*:*:*:*:*:*:*

More vulnerabilities in Redhat Ansible Automation Platform

CVE-2021-4112 — High (CVSS 8.8): A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw…
CVE-2023-50782 — High (CVSS 7.5): A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured…
CVE-2023-44487 — High (CVSS 7.5): The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset…
CVE-2021-20228 — High (CVSS 7.5): A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by…
CVE-2023-4237 — High (CVSS 7.3): A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the…
CVE-2023-3971 — High (CVSS 7.3): An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture…

All CVEs affecting Redhat Ansible Automation Platform →

Other CWE-647 vulnerabilities

CVE-2022-43939 — High (CVSS 8.6): Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security…
CVE-2025-64500 — High (CVSS 7.3): Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's…
CVE-2026-5222 — Medium (CVSS 6.5): Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol.…
CVE-2025-66202 — Medium (CVSS 6.5): Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated…
CVE-2025-47241 — Medium (CVSS 4.0): In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be…
CVE-2025-43916 — Low (CVSS 3.4): Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirect_uri containing…

Browse all CWE-647 vulnerabilities →