Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2026-12382

Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed Subject header matching a legitimate client certificate DN to bypass mTLS authentication and inject arbitrary events into protected EDA event streams.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Default version status: affected

  • 0:2.5.20260715-1.el8ap to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9

Default version status: affected

  • 0:2.5.20260715-1.el9ap to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9

Default version status: affected

  • 0:2.6.20260422-1.el9ap to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.6

Default version status: affected

  • 1777311120 to < *unaffected

Red Hat Red Hat Ansible Automation Platform 2.7

Default version status: affected

  • 1783919486 to < *unaffected

References