A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthenticated remote attacker can bypass mutual Transport Layer Security (mTLS) authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP Subject header.
The system also inadvertently discloses the expected certificate subject in error messages, which simplifies the attack. This vulnerability allows an attacker to inject arbitrary events into EDA, potentially triggering automated workflows.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 5
https://access.redhat.com/security/cve/CVE-2026-18141
secalert@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2508155
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2026:50336
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2026:50340
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2026:50479
secalert@redhat.com