Ansible Automation Platform EDA: event stream test mode exposes client credentials in the test_headers field

Impact

When an Event-Driven Ansible event stream is left in test mode, the test_headers field retains and exposes the incoming request headers to anyone with read access to that event stream. Those headers carry client credentials and internal infrastructure details, so a stored high-value token - a webhook secret, a proxy or service token - becomes readable by a wider set of platform users than intended and can be replayed for privilege escalation. Operators who drive fleet configuration from AAP should treat any token that ever passed through a test-mode stream as disclosed. The exposure is persistent: it sits in the stream record until cleared.

Who can reach it

Authenticated AAP user with read access to an event stream that is (or was) in test mode. Red Hat scores it local with high privilege required; no unauthenticated path.

What to do

Apply the AAP errata for your release (RHSA-2025:19201 / 19221 for 2.5, RHSA-2025:23069 / 23131 for 2.6) and restart the EDA services. Also take event streams out of test mode and rotate every credential that was sent to one while test mode was on - patching does not un-disclose what was already stored.

References

Related entries

• Ansible Automation Platform EDA: crafted requests and job templates leak trusted-proxy headers and stream URLsCVE-2025-9908 · Red Hat Ansible Automation Platform - Event-Driven Ansible Event StreamsMedium
• Ansible Automation Platform Gateway: double-slash gateway_path lets an admin plant a credential-harvesting routeCVE-2025-9909 · Red Hat Ansible Automation Platform Gateway (route creation, gateway_path)Medium
• ansible-core: symlinked ~/.ssh lets an unprivileged user on a managed node escalate to rootCVE-2026-123037 · ansible-core user module (generate_ssh_key symlink handling)Medium
• JumpServer: Jinja2 injection in Applet Host fields executes commands on the control nodeCVE-2026-44845 · JumpServer (Applet Host deployment, Jinja2 template injection)Medium
• ansible-core git module: repository URL starting with a dash is parsed as a git option, enabling command executionCVE-2026-84503 · ansible-core (ansible.builtin.git module)Medium
• GlusterFS (glusterd management): An authenticated TLS client can use gluster cli --remote-host to add itself to theCVE-2018-10841 · GlusterFS (glusterd management)Medium