CVE-2026-6266

Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linking

State: Published
Severity: 8.3 High
Published: May 4, 2026
Updated: Aug 27, 2026
Reserved: Apr 14, 2026

Description

A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a victim's account or gain unauthorized access to other accounts, including administrative accounts, by manipulating the IDP-provided email.

Scores

CVSS	Score	Vector	Source
3.1	8.3 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L	redhat
3.1	8.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N	redhat-SADP

Weaknesses

CWE-305 Authentication Bypass by Primary Weakness

Affected Products

Product	Versions
django-ansible-base	2.5.0 to before 2.5.20260422Affected 2.6.0 to before 2.6.20260422Affected
automation-controller	4.6.0 to before 4.6.28Affected 4.7.0 to before 4.7.11Affected
automation-gateway	2.5.0 to before 2.5.20260422Affected 2.6.0 to before 2.6.20260422Affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:4.6.28-3.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:2.5.20260422-2.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:2.5.20260422-2.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:4.6.28-3.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:2.5.20260422-2.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:2.5.20260422-2.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.6 for RHEL 9Red Hat	0:4.7.11-2.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.6 for RHEL 9Red Hat	0:2.6.20260422-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.6 for RHEL 9Red Hat	0:2.6.20260422-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.6Red Hat	1777377014 and laterNot affected
Red Hat Ansible Automation Platform 2.6Red Hat	1777311120 and laterNot affected

References

RHSA-2026:13508vendor-advisory
RHSA-2026:13512vendor-advisory
RHSA-2026:13545vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-6266vdb-entry
RHBZ#2458142issue-tracking
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6266.json

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.