CVE-2026-18141
Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header
- State
- Published
- Severity
- 8.2 High
- Published
- Jul 31, 2026
- Updated
- Aug 4, 2026
- Reserved
- Jul 28, 2026
Description
A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthenticated remote attacker can bypass mutual Transport Layer Security (mTLS) authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP Subject header. The system also inadvertently discloses the expected certificate subject in error messages, which simplifies the attack. This vulnerability allows an attacker to inject arbitrary events into EDA, potentially triggering automated workflows.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.2 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N | redhat |
Weaknesses
- CWE-295 Improper Certificate Validation
Affected Products
| Product | Versions |
|---|---|
Red Hat Ansible Automation Platform 2.6 for RHEL 9Red Hat |
|
Red Hat Ansible Automation Platform 2.6Red Hat |
|
Red Hat Ansible Automation Platform 2.7Red Hat |
|
Red Hat Ansible Automation Platform 2Red Hat |
References
- RHSA-2026:50336vendor-advisory
- RHSA-2026:50340vendor-advisory
- RHSA-2026:50479vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-18141vdb-entry
- RHBZ#2508155issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.