Skip to content
CVE PROGRAM SOURCE RECORD9.6 Critical

CVE-2026-11807

Eda-server: websocket missing authorization allows credential theft via activation_id spoofing

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messages. Any authenticated user can send a forged message with an arbitrary activation_id to receive plaintext credentials associated with that activation, including OAuth tokens, vault passwords, and SSH keys.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Default version status: affected

  • 0:1.1.19-1.el8ap to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9

Default version status: affected

  • 0:1.1.19-1.el9ap to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9

Default version status: affected

  • 0:1.2.9-2.el9ap to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.5

Default version status: affected

  • 1781741251 to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.6

Default version status: affected

  • 1781732675 to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.7

Default version status: affected

  • 1781730525 to < *unaffected

References