CVE-2026-18141
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
In the aap-gateway component of Ansible Automation Platform's Event-Driven Ansible (EDA), a vulnerability allows an unauthenticated remote attacker to bypass mTLS authentication for event streams. The attacker can manipulate the event stream URL and forge the HTTP Subject header, while the system inadvertently discloses the expected certificate subject in error messages.
Risk Assessment
An attacker can inject arbitrary events into EDA, potentially triggering automated workflows, leading to unauthorized actions in the Ansible environment.
Recommendation
Update the aap-gateway component to a patched version and implement additional authentication validation mechanisms.
Other vulnerabilities in aap-gateway
See all- CVE-2026-6266High
A flaw was found in the AAP gateway where the user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a victim's account or gain unauthorized access to other accounts, including administrative accounts, by manipulating the IDP-provided email.
- CVE-2024-10033Medium
A Cross-site Scripting (XSS) vulnerability exists in the aap-gateway component. A malicious user can exploit the "?next=" parameter in a URL to perform redirects, inject malicious scripts, and steal sessions and data.
Original NVD description (English source)
A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthenticated remote attacker can bypass mutual Transport Layer Security (mTLS) authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP Subject header. The system also inadvertently discloses the expected certificate subject in error messages, which simplifies the attack. This vulnerability allows an attacker to inject arbitrary events into EDA, potentially triggering automated workflows.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS