Vulnerability-Lookup

RHSA-2026:28376

Vulnerability from csaf_redhat - Published: 2026-06-23 18:53 - Updated: 2026-06-24 01:55

Summary

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security Update

Severity

Critical

Notes

Topic: An update is now available for Red Hat Ansible Automation Platform 2.5 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-eda-controller: Websocket missing authorization allows credential theft via activation_id spoofing (CVE-2026-11807) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-11807

A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messages. Any authenticated user can send a forged message with an arbitrary activation_id to receive plaintext credentials associated with that activation, including OAuth tokens, vault passwords, and SSH keys.

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CWE-862 - Missing Authorization

Affected products

Fixed 12 products

Product	Version	Remediation
Unresolved product id: 8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el8ap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el8ap.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-0:1.1.19-1.el8ap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-services-0:1.1.19-1.el8ap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-event-stream-services-0:1.1.19-1.el8ap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-worker-services-0:1.1.19-1.el8ap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el9ap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el9ap.src	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-0:1.1.19-1.el9ap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-services-0:1.1.19-1.el9ap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-event-stream-services-0:1.1.19-1.el9ap.noarch	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-worker-services-0:1.1.19-1.el9ap.noarch	—	Vendor Fix fix Workaround

Threats

Impact Critical

References

8 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:28376	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2487036	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-11807	self
https://bugzilla.redhat.com/show_bug.cgi?id=2487036	external
https://www.cve.org/CVERecord?id=CVE-2026-11807	external
https://nvd.nist.gov/vuln/detail/CVE-2026-11807	external

Acknowledgments

Red Hat, Inc. Chris Meyers

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat Ansible Automation Platform 2.5\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.\n\nSecurity Fix(es):\n\n* automation-eda-controller: Websocket missing authorization allows credential theft via activation_id spoofing (CVE-2026-11807)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:28376",
        "url": "https://access.redhat.com/errata/RHSA-2026:28376"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "2487036",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487036"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_28376.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security Update",
    "tracking": {
      "current_release_date": "2026-06-24T01:55:04+00:00",
      "generator": {
        "date": "2026-06-24T01:55:04+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.0.0"
        }
      },
      "id": "RHSA-2026:28376",
      "initial_release_date": "2026-06-23T18:53:04+00:00",
      "revision_history": [
        {
          "date": "2026-06-23T18:53:04+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-23T18:53:04+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-24T01:55:04+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
                "product": {
                  "name": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
                  "product_id": "9Base-Ansible-Automation-Platform-2.5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ansible_automation_platform:2.5::el9"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
                "product": {
                  "name": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
                  "product_id": "8Base-Ansible-Automation-Platform-2.5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ansible_automation_platform:2.5::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Ansible Automation Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "automation-eda-controller-0:1.1.19-1.el9ap.src",
                "product": {
                  "name": "automation-eda-controller-0:1.1.19-1.el9ap.src",
                  "product_id": "automation-eda-controller-0:1.1.19-1.el9ap.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/automation-eda-controller@1.1.19-1.el9ap?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "automation-eda-controller-0:1.1.19-1.el8ap.src",
                "product": {
                  "name": "automation-eda-controller-0:1.1.19-1.el8ap.src",
                  "product_id": "automation-eda-controller-0:1.1.19-1.el8ap.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/automation-eda-controller@1.1.19-1.el8ap?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "automation-eda-controller-0:1.1.19-1.el9ap.noarch",
                "product": {
                  "name": "automation-eda-controller-0:1.1.19-1.el9ap.noarch",
                  "product_id": "automation-eda-controller-0:1.1.19-1.el9ap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/automation-eda-controller@1.1.19-1.el9ap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "automation-eda-controller-base-0:1.1.19-1.el9ap.noarch",
                "product": {
                  "name": "automation-eda-controller-base-0:1.1.19-1.el9ap.noarch",
                  "product_id": "automation-eda-controller-base-0:1.1.19-1.el9ap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/automation-eda-controller-base@1.1.19-1.el9ap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "automation-eda-controller-base-services-0:1.1.19-1.el9ap.noarch",
                "product": {
                  "name": "automation-eda-controller-base-services-0:1.1.19-1.el9ap.noarch",
                  "product_id": "automation-eda-controller-base-services-0:1.1.19-1.el9ap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/automation-eda-controller-base-services@1.1.19-1.el9ap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "automation-eda-controller-event-stream-services-0:1.1.19-1.el9ap.noarch",
                "product": {
                  "name": "automation-eda-controller-event-stream-services-0:1.1.19-1.el9ap.noarch",
                  "product_id": "automation-eda-controller-event-stream-services-0:1.1.19-1.el9ap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/automation-eda-controller-event-stream-services@1.1.19-1.el9ap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "automation-eda-controller-worker-services-0:1.1.19-1.el9ap.noarch",
                "product": {
                  "name": "automation-eda-controller-worker-services-0:1.1.19-1.el9ap.noarch",
                  "product_id": "automation-eda-controller-worker-services-0:1.1.19-1.el9ap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/automation-eda-controller-worker-services@1.1.19-1.el9ap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "automation-eda-controller-0:1.1.19-1.el8ap.noarch",
                "product": {
                  "name": "automation-eda-controller-0:1.1.19-1.el8ap.noarch",
                  "product_id": "automation-eda-controller-0:1.1.19-1.el8ap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/automation-eda-controller@1.1.19-1.el8ap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "automation-eda-controller-base-0:1.1.19-1.el8ap.noarch",
                "product": {
                  "name": "automation-eda-controller-base-0:1.1.19-1.el8ap.noarch",
                  "product_id": "automation-eda-controller-base-0:1.1.19-1.el8ap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/automation-eda-controller-base@1.1.19-1.el8ap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "automation-eda-controller-base-services-0:1.1.19-1.el8ap.noarch",
                "product": {
                  "name": "automation-eda-controller-base-services-0:1.1.19-1.el8ap.noarch",
                  "product_id": "automation-eda-controller-base-services-0:1.1.19-1.el8ap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/automation-eda-controller-base-services@1.1.19-1.el8ap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "automation-eda-controller-event-stream-services-0:1.1.19-1.el8ap.noarch",
                "product": {
                  "name": "automation-eda-controller-event-stream-services-0:1.1.19-1.el8ap.noarch",
                  "product_id": "automation-eda-controller-event-stream-services-0:1.1.19-1.el8ap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/automation-eda-controller-event-stream-services@1.1.19-1.el8ap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "automation-eda-controller-worker-services-0:1.1.19-1.el8ap.noarch",
                "product": {
                  "name": "automation-eda-controller-worker-services-0:1.1.19-1.el8ap.noarch",
                  "product_id": "automation-eda-controller-worker-services-0:1.1.19-1.el8ap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/automation-eda-controller-worker-services@1.1.19-1.el8ap?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "automation-eda-controller-0:1.1.19-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8",
          "product_id": "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el8ap.noarch"
        },
        "product_reference": "automation-eda-controller-0:1.1.19-1.el8ap.noarch",
        "relates_to_product_reference": "8Base-Ansible-Automation-Platform-2.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "automation-eda-controller-0:1.1.19-1.el8ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8",
          "product_id": "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el8ap.src"
        },
        "product_reference": "automation-eda-controller-0:1.1.19-1.el8ap.src",
        "relates_to_product_reference": "8Base-Ansible-Automation-Platform-2.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "automation-eda-controller-base-0:1.1.19-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8",
          "product_id": "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-0:1.1.19-1.el8ap.noarch"
        },
        "product_reference": "automation-eda-controller-base-0:1.1.19-1.el8ap.noarch",
        "relates_to_product_reference": "8Base-Ansible-Automation-Platform-2.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "automation-eda-controller-base-services-0:1.1.19-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8",
          "product_id": "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-services-0:1.1.19-1.el8ap.noarch"
        },
        "product_reference": "automation-eda-controller-base-services-0:1.1.19-1.el8ap.noarch",
        "relates_to_product_reference": "8Base-Ansible-Automation-Platform-2.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "automation-eda-controller-event-stream-services-0:1.1.19-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8",
          "product_id": "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-event-stream-services-0:1.1.19-1.el8ap.noarch"
        },
        "product_reference": "automation-eda-controller-event-stream-services-0:1.1.19-1.el8ap.noarch",
        "relates_to_product_reference": "8Base-Ansible-Automation-Platform-2.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "automation-eda-controller-worker-services-0:1.1.19-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8",
          "product_id": "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-worker-services-0:1.1.19-1.el8ap.noarch"
        },
        "product_reference": "automation-eda-controller-worker-services-0:1.1.19-1.el8ap.noarch",
        "relates_to_product_reference": "8Base-Ansible-Automation-Platform-2.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "automation-eda-controller-0:1.1.19-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9",
          "product_id": "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el9ap.noarch"
        },
        "product_reference": "automation-eda-controller-0:1.1.19-1.el9ap.noarch",
        "relates_to_product_reference": "9Base-Ansible-Automation-Platform-2.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "automation-eda-controller-0:1.1.19-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9",
          "product_id": "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el9ap.src"
        },
        "product_reference": "automation-eda-controller-0:1.1.19-1.el9ap.src",
        "relates_to_product_reference": "9Base-Ansible-Automation-Platform-2.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "automation-eda-controller-base-0:1.1.19-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9",
          "product_id": "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-0:1.1.19-1.el9ap.noarch"
        },
        "product_reference": "automation-eda-controller-base-0:1.1.19-1.el9ap.noarch",
        "relates_to_product_reference": "9Base-Ansible-Automation-Platform-2.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "automation-eda-controller-base-services-0:1.1.19-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9",
          "product_id": "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-services-0:1.1.19-1.el9ap.noarch"
        },
        "product_reference": "automation-eda-controller-base-services-0:1.1.19-1.el9ap.noarch",
        "relates_to_product_reference": "9Base-Ansible-Automation-Platform-2.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "automation-eda-controller-event-stream-services-0:1.1.19-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9",
          "product_id": "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-event-stream-services-0:1.1.19-1.el9ap.noarch"
        },
        "product_reference": "automation-eda-controller-event-stream-services-0:1.1.19-1.el9ap.noarch",
        "relates_to_product_reference": "9Base-Ansible-Automation-Platform-2.5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "automation-eda-controller-worker-services-0:1.1.19-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9",
          "product_id": "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-worker-services-0:1.1.19-1.el9ap.noarch"
        },
        "product_reference": "automation-eda-controller-worker-services-0:1.1.19-1.el9ap.noarch",
        "relates_to_product_reference": "9Base-Ansible-Automation-Platform-2.5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Chris Meyers"
          ],
          "organization": "Red Hat, Inc.",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-11807",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2026-06-09T15:42:49.367000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487036"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messages. Any authenticated user can send a forged message with an arbitrary activation_id to receive plaintext credentials associated with that activation, including OAuth tokens, vault passwords, and SSH keys.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "eda-server: websocket missing authorization allows credential theft via activation_id spoofing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el8ap.noarch",
          "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el8ap.src",
          "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-0:1.1.19-1.el8ap.noarch",
          "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-services-0:1.1.19-1.el8ap.noarch",
          "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-event-stream-services-0:1.1.19-1.el8ap.noarch",
          "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-worker-services-0:1.1.19-1.el8ap.noarch",
          "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el9ap.noarch",
          "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el9ap.src",
          "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-0:1.1.19-1.el9ap.noarch",
          "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-services-0:1.1.19-1.el9ap.noarch",
          "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-event-stream-services-0:1.1.19-1.el9ap.noarch",
          "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-worker-services-0:1.1.19-1.el9ap.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-11807"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487036",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487036"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-11807",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11807"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11807",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11807"
        }
      ],
      "release_date": "2026-06-23T14:27:28.309000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-23T18:53:04+00:00",
          "details": "For details on how to apply this update, refer to Ansible Automation Platform documentation.",
          "product_ids": [
            "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el8ap.noarch",
            "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el8ap.src",
            "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-0:1.1.19-1.el8ap.noarch",
            "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-services-0:1.1.19-1.el8ap.noarch",
            "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-event-stream-services-0:1.1.19-1.el8ap.noarch",
            "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-worker-services-0:1.1.19-1.el8ap.noarch",
            "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el9ap.noarch",
            "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el9ap.src",
            "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-0:1.1.19-1.el9ap.noarch",
            "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-services-0:1.1.19-1.el9ap.noarch",
            "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-event-stream-services-0:1.1.19-1.el9ap.noarch",
            "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-worker-services-0:1.1.19-1.el9ap.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:28376"
        },
        {
          "category": "workaround",
          "details": "The following practices would help for reducing or avoiding the exposure to this flaw:\n\n1) Restrict network access to the EDA websocket endpoint.\n2) Review and limit user accounts with any level of Ansible Automation Platform authentication until the fix is applied.",
          "product_ids": [
            "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el8ap.noarch",
            "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el8ap.src",
            "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-0:1.1.19-1.el8ap.noarch",
            "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-services-0:1.1.19-1.el8ap.noarch",
            "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-event-stream-services-0:1.1.19-1.el8ap.noarch",
            "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-worker-services-0:1.1.19-1.el8ap.noarch",
            "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el9ap.noarch",
            "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el9ap.src",
            "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-0:1.1.19-1.el9ap.noarch",
            "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-services-0:1.1.19-1.el9ap.noarch",
            "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-event-stream-services-0:1.1.19-1.el9ap.noarch",
            "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-worker-services-0:1.1.19-1.el9ap.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el8ap.noarch",
            "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el8ap.src",
            "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-0:1.1.19-1.el8ap.noarch",
            "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-services-0:1.1.19-1.el8ap.noarch",
            "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-event-stream-services-0:1.1.19-1.el8ap.noarch",
            "8Base-Ansible-Automation-Platform-2.5:automation-eda-controller-worker-services-0:1.1.19-1.el8ap.noarch",
            "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el9ap.noarch",
            "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-0:1.1.19-1.el9ap.src",
            "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-0:1.1.19-1.el9ap.noarch",
            "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-base-services-0:1.1.19-1.el9ap.noarch",
            "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-event-stream-services-0:1.1.19-1.el9ap.noarch",
            "9Base-Ansible-Automation-Platform-2.5:automation-eda-controller-worker-services-0:1.1.19-1.el9ap.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "eda-server: websocket missing authorization allows credential theft via activation_id spoofing"
    }
  ]
}

CVE-2026-11807 (GCVE-0-2026-11807)

Vulnerability from cvelistv5 – Published: 2026-06-23 19:40 – Updated: 2026-06-24 01:39

Title

Eda-server: websocket missing authorization allows credential theft via activation_id spoofing

Summary

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CWE

CWE-862 - Missing Authorization

Assigner

redhat

References

6 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:28376	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28377	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28492	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28497	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-11807	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2487036	issue-trackingx_refsource_REDHAT

Impacted products

5 products

Vendor	Product	Version
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	Unaffected: 0:1.1.19-1.el8ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.5::el8 cpe:/a:redhat:ansible_automation_platform:2.5::el9
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 9	Unaffected: 0:1.1.19-1.el9ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.5::el8 cpe:/a:redhat:ansible_automation_platform:2.5::el9
Red Hat	Red Hat Ansible Automation Platform 2.6 for RHEL 9	Unaffected: 0:1.2.9-2.el9ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.6::el9
Red Hat	Red Hat Ansible Automation Platform 2.5	Unaffected: 1781741251 , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.5::el8
Red Hat	Red Hat Ansible Automation Platform 2.6	Unaffected: 1781732675 , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.6::el9

Date Public

2026-06-23 14:27

Credits

This issue was discovered by Chris Meyers (Red Hat, Inc.).

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform:2.5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "automation-eda-controller",
          "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.1.19-1.el8ap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform:2.5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "automation-eda-controller",
          "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.1.19-1.el9ap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "automation-eda-controller",
          "product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.2.9-2.el9ap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2.5::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "ansible-automation-platform-25/eda-controller-rhel8",
          "product": "Red Hat Ansible Automation Platform 2.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1781741251",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "ansible-automation-platform-26/eda-controller-rhel9",
          "product": "Red Hat Ansible Automation Platform 2.6",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1781732675",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was discovered by Chris Meyers (Red Hat, Inc.)."
        }
      ],
      "datePublic": "2026-06-23T14:27:28.309Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messages. Any authenticated user can send a forged message with an arbitrary activation_id to receive plaintext credentials associated with that activation, including OAuth tokens, vault passwords, and SSH keys."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Critical"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-24T01:39:13.071Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:28376",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:28376"
        },
        {
          "name": "RHSA-2026:28377",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:28377"
        },
        {
          "name": "RHSA-2026:28492",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:28492"
        },
        {
          "name": "RHSA-2026:28497",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:28497"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-11807"
        },
        {
          "name": "RHBZ#2487036",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487036"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-09T15:42:49.367Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-06-23T14:27:28.309Z",
          "value": "Made public."
        }
      ],
      "title": "Eda-server: websocket missing authorization allows credential theft via activation_id spoofing",
      "workarounds": [
        {
          "lang": "en",
          "value": "The following practices would help for reducing or avoiding the exposure to this flaw:\n\n1) Restrict network access to the EDA websocket endpoint.\n2) Review and limit user accounts with any level of Ansible Automation Platform authentication until the fix is applied."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-862: Missing Authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-11807",
    "datePublished": "2026-06-23T19:40:33.182Z",
    "dateReserved": "2026-06-09T15:41:49.114Z",
    "dateUpdated": "2026-06-24T01:39:13.071Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

RHSA-2026:28376

CVE-2026-11807 (GCVE-0-2026-11807)

Tags

Sightings

Nomenclature