by Kastro CVE-2026-11807
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 — Eda-server: websocket missing authorization allows credential theft via activation_id spoofing
Description · from the CVE record
A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messages. Any authenticated user can send a forged message with an arbitrary activation_id to receive plaintext credentials associated with that activation, including OAuth tokens, vault passwords, and SSH keys.
Affected
ProductAffectedFixed inSource
Red Hat Ansible Automation Platform 2.5 for RHEL 8see advisory0:1.1.19-1.el8apCNA
Red Hat Ansible Automation Platform 2.5 for RHEL 9see advisory0:1.1.19-1.el9apCNA
Red Hat Ansible Automation Platform 2.6 for RHEL 9see advisory0:1.2.9-2.el9apCNA
Red Hat Ansible Automation Platform 2.5see advisory1781741251CNA
Red Hat Ansible Automation Platform 2.6see advisory1781732675CNA
Red Hat Ansible Automation Platform 2.7see advisory1781730525CNA
Red Hat Ansible Automation Platform 2.5 for RHEL 8see advisory0:1.1.19-1.el8apredhat-SADP
Red Hat Ansible Automation Platform 2.5 for RHEL 9see advisory0:1.1.19-1.el9apredhat-SADP
Red Hat Ansible Automation Platform 2.6 for RHEL 9see advisory0:1.2.9-2.el9apredhat-SADP
Red Hat Ansible Automation Platform 2.5see advisory1781741251redhat-SADP
Red Hat Ansible Automation Platform 2.6see advisory1781732675redhat-SADP
Red Hat Ansible Automation Platform 2.7see advisory1781730525redhat-SADP
Scores by source
redhat (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
redhat-SADP (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial