Cyber Resilience

CVE-2025-9909

Redhat Ansible Developer 1.2 … 1.3

Published
27 February 2026
Modified
25 March 2026
Patch / advisory
View advisory
CVSS Score v3.1 6.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0017 6th percentile
Risk Priority 45 floored blend · peak EPSS

Summary

CVE-2025-9909 is a medium-severity Use of Non-Canonical URL Paths for Authorization Decisions (CWE-647) vulnerability in Redhat Ansible Developer. Its CVSS base score is 6.7 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to CM-5 (Access Restrictions for Change) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of misleading routes using a double-slash (//) prefix in the gateway_path. A malicious or socially engineered administrator…

more

can configure a honey-pot route to intercept and exfiltrate user credentials, potentially maintaining persistent access or creating a backdoor even after their permissions are revoked.

CWE(s)
CWE-647

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
attack.mitre.org →
Why these techniques?

Vulnerability directly enables creation of deceptive routes for intercepting credentials, mapping to Adversary-in-the-Middle.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-9908Same product: Redhat Ansible Automation Platform
CVE-2023-4380Same product: Redhat Ansible Automation Platform
CVE-2024-10033Same product: Redhat Ansible Automation Platform
CVE-2025-9907Same product: Redhat Ansible Automation Platform
CVE-2023-3971Same product: Redhat Ansible Automation Platform
CVE-2023-5115Same product: Redhat Ansible Automation Platform
CVE-2024-0690Same product: Redhat Ansible Automation Platform
CVE-2026-3012Same product: Redhat Enterprise Linux
CVE-2026-3833Same product: Redhat Enterprise Linux
CVE-2025-53862Same product: Redhat Ansible Automation Platform

Affected Assets

redhat
ansible automation platform
≤ 2.6
redhat
ansible developer
1.2, 1.3
redhat
ansible inside
1.3, 1.4

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • CM-5 Access Restrictions for Change
  • AC-6 Least Privilege
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V2.2.1
  • V10.4.1

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly blocks creation of malicious gateway_path values containing double-slash prefixes that enable credential-harvesting routes.

CM-5 Access Restrictions for Change good match
prevent

Enforces access restrictions and approvals on route-configuration changes, limiting a malicious administrator's ability to install honey-pot routes.

AC-6 Least Privilege partial match
prevent

Applies least privilege to the route-creation permission set so fewer accounts can introduce misleading gateway paths.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

Enforcing well-defined authorization policies prevents URL canonicalization bypasses when path handling is included in the implementation.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing can discover non-canonical URL bypasses but does not itself implement the preventive control.

A.8.26 Application security requirements partial match
prevents

Defining application security requirements that mandate canonical URL handling and authorization checks mitigates the weakness at design time.

A.8.28 Secure coding partial match
prevents

Secure-coding standards that require URL canonicalization and safe path handling eliminate the root cause of the weakness.

A.8.3 Information access restriction partial match
prevents

Enforcing strict access-control rules on canonical resource identifiers directly prevents authorization bypass via non-canonical URLs.

References