Skip to content
Fencer Vulns
high 8.2

CVE-2026-18141 json

Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header

published 2026-07-31 3 mo ago modified 2026-08-04 3 mo ago also EUVD-2026-51556

cvss
8.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits
0
none known

Summary

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthenticated remote attacker can bypass mutual Transport Layer Security (mTLS) authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP Subject header. The system also inadvertently discloses the expected certificate subject in error messages, which simplifies the attack. This vulnerability allows an attacker to inject arbitrary events into EDA, potentially triggering automated workflows.

Patch / fix

  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:1.2.11-1.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.6 1785780020
  • Red Hat Red Hat Ansible Automation Platform 2.7 1785435970
  • receptor ansible automation platform 2.6 1.6.7-1.el10ap
  • receptor ansible automation platform inside 2.6, ansible automation platform developer 2.6, ansible automation platform 2.6 1.6.7-1.el9ap
  • receptorctl ansible automation platform 2.6 1.6.7-1.el10ap
  • receptorctl ansible automation platform inside 2.6, ansible automation platform developer 2.6, ansible automation platform 2.6 1.6.7-1.el9ap
  • python3.12-daphne ansible automation platform 2.6 4.2.2-1.el9ap
  • python3.12-pillow ansible automation platform 2.6 12.3.0-1.el9ap
  • python3.12-pyasn1 ansible automation platform 2.6 0.6.4-1.el9ap
  • python3.12-aiohttp ansible automation platform 2.6 3.14.1-2.el9ap

red hat advisories RHSA-2026:50336

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-18141 updated cvss 8.2

aap-gateway: aap-gateway: Authentication bypass in Event-Driven Ansible via forged HTTP header

  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/gateway-rhel9 1785780020
    fixed: vendor fix RHSA-2026:50479
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-eda-controller 1.2.11-1.el9ap, automation-eda-controller-base 1.2.11-1.el9ap, automation-eda-controller-base-services 1.2.11-1.el9ap, automation-eda-controller-worker-services 1.2.11-1.el9ap, automation-eda-controller-event-stream-services 1.2.11-1.el9ap
    fixed: vendor fix RHSA-2026:50336
  • Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/gateway-rhel9 1785435970
    fixed: vendor fix RHSA-2026:50340
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-25/gateway-rhel8 Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1785753568, ansible-automation-platform-26/hub-web-rhel9 1785756951, ansible-automation-platform-26/receptor-rhel9 1785632117, ansible-automation-platform-26/mcp-tools-rhel9 1785633968, ansible-automation-platform-26/controller-rhel9 1785753810, ansible-automation-platform-26/de-minimal-rhel9 1785647559, +24 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.7-1.el9ap, receptorctl 1.6.7-1.el9ap, automation-hub 4.11.12-1.el9ap, python3.12-daphne 4.2.2-1.el9ap, python3.12-pyasn1 0.6.4-1.el9ap, ansible-dev-tools 26.7.2-1.el9ap, +30 more Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.7-1.el10ap, receptorctl 1.6.7-1.el10ap, ansible-dev-tools 26.7.2-1.el10ap, python-tox-ansible 26.7.1-1.el10ap, python3-tox-ansible 26.7.1-1.el10ap, ansible-dev-tools+server 26.7.2-1.el10ap Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-rhel9 1785376164, ansible-automation-platform-27/hub-web-rhel9 1785379466, ansible-automation-platform-27/receptor-rhel9 1785389482, ansible-automation-platform-27/mcp-tools-rhel9 1785374970, ansible-automation-platform-27/controller-rhel9 1785378052, ansible-automation-platform-27/de-minimal-rhel9 1785446384, +25 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Affected products

  • Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.6
  • Red Hat Red Hat Ansible Automation Platform 2.7
  • Red Hat Red Hat Ansible Automation Platform 2

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.