CVE-2026-6266
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A flaw was found in the AAP gateway where the user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a victim's account or gain unauthorized access to other accounts, including administrative accounts, by manipulating the IDP-provided email.
Risk Assessment
The organization is at risk of account takeover, including administrative accounts, which could lead to unauthorized access to sensitive data and systems managed by AAP.
Recommendation
Immediately disable the user auto-link strategy in the AAP configuration or implement additional verification of email ownership before linking an IDP identity to an account.
Other vulnerabilities in AAP Gateway
See all- CVE-2026-18141High
In the aap-gateway component of Ansible Automation Platform's Event-Driven Ansible (EDA), a vulnerability allows an unauthenticated remote attacker to bypass mTLS authentication for event streams. The attacker can manipulate the event stream URL and forge the HTTP Subject header, while the system inadvertently discloses the expected certificate subject in error messages.
- CVE-2024-10033Medium
A Cross-site Scripting (XSS) vulnerability exists in the aap-gateway component. A malicious user can exploit the "?next=" parameter in a URL to perform redirects, inject malicious scripts, and steal sessions and data.
Original NVD description (English source)
A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a victim's account or gain unauthorized access to other accounts, including administrative accounts, by manipulating the IDP-provided email.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS