CVE-2026-11807: falha crítica em Red Hat Ansible Automation Platform 2.5
Eda-server: websocket missing authorization allows credential theft via activation_id spoofing
Publicada em · Atualizada em
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.6epss 0.5%
probabilidade de exploração
0.5%top 57% das CVEs
exploração observada
nãonenhuma fonte reporta
A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messages. Any authenticated user can send a forged message with an arbitrary activation_id to receive plaintext credentials associated with that activation, including OAuth tokens, vault passwords, and SSH keys.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Produtos afetados
Red Hat · Red Hat Ansible Automation Platform 2.5Red Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat · Red Hat Ansible Automation Platform 2.6Red Hat · Red Hat Ansible Automation Platform 2.6 for RHEL 9Red Hat · Red Hat Ansible Automation Platform 2.7CVEs relacionadas — Red Hat Ansible Automation Platform 2.5
No mesmo produto, das mais perigosas para as menos.
CVE-2026-71364HIGHAwx: project archive extraction allows path traversal file writesEPSS 1.7%CVE-2026-12701CRITICALPulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexportEPSS 1.2%CVE-2026-84474CRITICALAutomation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioning-callback host matchEPSS 0.8%CVE-2026-84502CRITICALAutomation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane podEPSS 0.6%CVE-2025-49520HIGHEvent-driven-ansible: authenticated argument injection in git url in eda project creationEPSS 0.6%CVE-2025-49521HIGHEvent-driven-ansible: template injection via git branch and refspec in eda projectsEPSS 0.6%
Referências
https://access.redhat.com/errata/RHSA-2026:28376https://access.redhat.com/errata/RHSA-2026:28377https://access.redhat.com/errata/RHSA-2026:28440https://access.redhat.com/errata/RHSA-2026:28492https://access.redhat.com/errata/RHSA-2026:28497https://access.redhat.com/security/cve/CVE-2026-11807https://bugzilla.redhat.com/show_bug.cgi?id=2487036https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11807.json