CVE-2025-9909: Red Hat Ansible Automation Platform

Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days.

A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of misleading routes using a double-slash (//) prefix in the gateway_path. A malicious or socially engineered administrator can configure a honey-pot route to intercept and exfiltrate user credentials, potentially maintaining persistent access or creating a backdoor even after their permissions are revoked.

Affected products

• Red Hat Ansible Automation Platform: before 2.6 (fixed in 2.6)
• Red Hat Ansible Developer: version 1.2 only; version 1.3 only
• Red Hat Ansible Inside: version 1.3 only; version 1.4 only

Published 2026-02-27. Last modified 2026-06-17.