VDB

CVE-2026-12382

CVE-2026-12382 PUBLISHED CVSS 8.2 HIGH

Reported by redhat · Published July 15, 2026

A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed Subject header matching a legitimate client certificate DN to bypass mTLS authentication and inject arbitrary events into protected EDA event streams.

Risk Scores

CVSS 3.1
8.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Affected Products

VendorProductVersions
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:2.5.20260715-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:2.5.20260715-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 90:2.6.20260422-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.61777311120
Red HatRed Hat Ansible Automation Platform 2.71783919486
Red HatRed Hat Ansible Automation Platform 2.61777311120
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:2.5.20260715-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.71783919486
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:2.5.20260715-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 90:2.6.20260422-1.el9ap
Red HatRed Hat Ansible Automation Platform 2
Red HatRed Hat Ansible Automation Platform 2

Timeline

  • Jul 15, 2026 Coalition ESS Score
  • Jul 15, 2026 CVE Published
  • Aug 7, 2026 EPSS Score
  • Aug 12, 2026 CVE Updated
  • Aug 13, 2026 Distribution Patch
  • Aug 13, 2026 Distribution Patch
  • Aug 13, 2026 Distribution Patch
  • Aug 13, 2026 Distribution Patch
  • Aug 13, 2026 Security Advisory
  • Aug 13, 2026 Security Advisory
  • Aug 13, 2026 Security Advisory
  • Aug 13, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›