Vulnerability in Red Hat Ansible Automation Platform 2
CVE-2026-12382
A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed Subject header matching a legitimate client certificate DN to bypass mTLS authentication and inject arbitrary events into protected EDA event streams.
EPSS: 0.005 (38.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N.
Affected products
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.5 For Rhel 8 — versions 0:2.5.20260715-1.el8ap
- Red Hat Ansible Automation Platform 2.5 For Rhel 9 — versions 0:2.5.20260715-1.el9ap
- Red Hat Ansible Automation Platform 2.6 — versions 1777311120
- Red Hat Ansible Automation Platform 2.6 For Rhel 9 — versions 0:2.6.20260422-1.el9ap
- Red Hat Ansible Automation Platform 2.7 — versions 1783919486
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_REDHAT, vdb-entry)
- secalert@redhat.com (x_refsource_REDHAT, issue-tracking)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
Frequently asked questions
- What is CVE-2026-12382?
- CVE-2026-12382 is a high-severity vulnerability in Red Hat Ansible Automation Platform 2, classified under Authentication Bypass by Spoofing. CVSS score: 8.2/10. Published 2026-07-15.
- How severe is CVE-2026-12382?
- High severity. CVSS v3 base score is 8.2 out of 10.