VDB
RHSA-2026:50319
RHSA-2026:50319
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowAny], authentication_classes=[]) and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a trusted proxy. Additionally, the expected certificate Distinguished Name is leaked in the 403 error response body. An attacker who can reach the EDA API endpoint with a spoofed Subject header can inject arbitrary events into mTLS-protected event streams, triggering downstream automation actions.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | python3.12-pyasn1-0:0.6.4-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:0.6.4-1.el9ap |
| Red Hat | automation-controller-0:4.6.31-1.el9ap.s390x as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:4.6.31-1.el9ap |
| Red Hat | automation-gateway-proxy-server-0:2.6.17-2.el9ap.ppc64le as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:2.6.17-2.el9ap |
| Red Hat | python3.12-aiohttp-debugsource-0:3.14.1-2.el8ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:3.14.1-2.el8ap |
| Red Hat | python3.12-galaxy-ng-0:4.10.17-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:4.10.17-1.el9ap |
| Red Hat | automation-gateway-proxy-debugsource-0:2.6.17-2.el9ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:2.6.17-2.el9ap |
| Red Hat | receptor-debugsource-0:1.6.7-1.el8ap.aarch64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:1.6.7-1.el8ap |
| Red Hat | receptor-0:1.6.7-1.el9ap.s390x as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:1.6.7-1.el9ap |
| Red Hat | python3.12-pillow-0:12.3.0-1.el8ap.aarch64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:12.3.0-1.el8ap |
| Red Hat | receptor-debugsource-0:1.6.7-1.el9ap.s390x as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:1.6.7-1.el9ap |
| Red Hat | automation-controller-0:4.6.31-1.el9ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:4.6.31-1.el9ap |
| Red Hat | python3.12-aiohttp-debuginfo-0:3.14.1-2.el9ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:3.14.1-2.el9ap |
| Red Hat | python3.12-aiohttp-0:3.14.1-2.el9ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:3.14.1-2.el9ap |
| Red Hat | automation-controller-0:4.6.31-1.el8ap.aarch64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:4.6.31-1.el8ap |
| Red Hat | automation-controller-0:4.6.31-1.el8ap.ppc64le as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:4.6.31-1.el8ap |
| Red Hat | automation-gateway-server-0:2.5.20260804-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:2.5.20260804-1.el9ap |
| Red Hat | automation-controller-venv-tower-0:4.6.31-1.el9ap.ppc64le as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:4.6.31-1.el9ap |
| Red Hat | python3.12-pulpcore-0:3.49.66-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:3.49.66-1.el9ap |
| Red Hat | python3.12-pillow-0:12.3.0-1.el9ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:12.3.0-1.el9ap |
| Red Hat | automation-gateway-0:2.5.20260804-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:2.5.20260804-1.el8ap |
…and 160 more
Timeline
- Aug 4, 2026 CVE Published
- Aug 21, 2026 CVE Updated
- Aug 21, 2026 Distribution Patch
- Aug 21, 2026 Distribution Patch
- Aug 21, 2026 Security Advisory
- Aug 21, 2026 Security Advisory
- Aug 21, 2026 Security Advisory
- Aug 21, 2026 Security Advisory
- Aug 21, 2026 Security Advisory
- Aug 21, 2026 Security Advisory
- Aug 21, 2026 Security Advisory
- Aug 21, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:50319 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases advisory
- https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467822 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2482734 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2484099 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2484207 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2484377 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2484875 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2489127 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2497452 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2497455 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2497464 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2497466 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2500041 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2500043 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2500380 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50319.json advisory
- https://access.redhat.com/security/cve/CVE-2026-12383 advisory
…and 71 more