Description
A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messages. Any authenticated user can send a forged message with an arbitrary activation_id to receive plaintext credentials associated with that activation, including OAuth tokens, vault passwords, and SSH keys.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None
References
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:28376
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:28377
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:28492
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:28497
- VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2026-11807
- MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2487036