Cyber Resilience

CVE-2025-9909

Redhat Ansible Developer 1.2 … 1.3

Published
27 February 2026
Modified
25 March 2026
Patch / advisory
View advisory
CVSS Score v3.1 6.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0017 6th percentile
Risk Priority 47 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2025-9909 is a medium-severity Use of Non-Canonical URL Paths for Authorization Decisions (CWE-647) vulnerability in Redhat Ansible Developer. Its CVSS base score is 6.7 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of misleading routes using a double-slash (//) prefix in the gateway_path. A malicious or socially engineered administrator…

more

can configure a honey-pot route to intercept and exfiltrate user credentials, potentially maintaining persistent access or creating a backdoor even after their permissions are revoked.

CWE(s)
CWE-647

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-10033Same product: Redhat Ansible Automation Platform
CVE-2023-4380Same product: Redhat Ansible Automation Platform
CVE-2025-9908Same product: Redhat Ansible Automation Platform
CVE-2025-9907Same product: Redhat Ansible Automation Platform
CVE-2023-5115Same product: Redhat Ansible Automation Platform
CVE-2023-3971Same product: Redhat Ansible Automation Platform
CVE-2026-11770Same product: Redhat Enterprise Linux
CVE-2024-6237Same product: Redhat Enterprise Linux
CVE-2026-28368Same product: Redhat Enterprise Linux
CVE-2026-28369Same product: Redhat Enterprise Linux

Affected Assets

redhat
ansible automation platform
≤ 2.6
redhat
ansible developer
1.2, 1.3
redhat
ansible inside
1.3, 1.4

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V2.2.1
  • V10.4.1

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

Proper enforcement of authorization decisions requires canonical URL normalization before policy evaluation, directly stopping non-canonical bypasses.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

Enforcing well-defined authorization policies prevents URL canonicalization bypasses when path handling is included in the implementation.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can discover non-canonical URL bypasses but does not itself implement the preventive control.

A.8.26 Application security requirements partial match
prevents

Defining application security requirements that mandate canonical URL handling and authorization checks mitigates the weakness at design time.

A.8.28 Secure coding partial match
prevents

Secure-coding standards that require URL canonicalization and safe path handling eliminate the root cause of the weakness.

A.8.3 Information access restriction partial match
prevents

Enforcing strict access-control rules on canonical resource identifiers directly prevents authorization bypass via non-canonical URLs.

References