What is CVE-2026-12382?

CVE-2026-12382 is a high-severity vulnerability in Red Hat Ansible Automation Platform 2, classified under Authentication Bypass by Spoofing. CVSS score: 8.2/10. Published 2026-07-15.

How severe is CVE-2026-12382?

High severity. CVSS v3 base score is 8.2 out of 10.

Vulnerability in Red Hat Ansible Automation Platform 2

CVE-2026-12382

A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. A…

CVSS v3 metric

CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N.

Affected products

Red Hat Ansible Automation Platform 2

Weakness classification (CWE)

CWE-290 — Authentication Bypass by Spoofing

References

secalert@redhat.com (x_refsource_REDHAT, vdb-entry)
secalert@redhat.com (x_refsource_REDHAT, issue-tracking)

Frequently asked questions

What is CVE-2026-12382?: CVE-2026-12382 is a high-severity vulnerability in Red Hat Ansible Automation Platform 2, classified under Authentication Bypass by Spoofing. CVSS score: 8.2/10. Published 2026-07-15.
How severe is CVE-2026-12382?: High severity. CVSS v3 base score is 8.2 out of 10.